CVE-2024-34716: XSS in PrestaShop 8.1.x

The impact of this XSS vulnerability is significant. A successful exploit allows an attacker to upload a malicious file containing JavaScript code via the contact form. When an administrator opens this file in the back office, the script executes within the administrator's session context. This grants the attacker the ability to steal the administrator's session cookie, effectively impersonating the administrator and performing any action they are authorized to do. This includes accessing sensitive customer data, modifying product information, processing fraudulent orders, and potentially gaining complete control over the e-commerce platform. The attack surface is limited to PrestaShop installations with the customer-thread feature enabled, but this feature is commonly used for customer support interactions, increasing the likelihood of exploitation.

1. Reserved2024-05-07
2. Published2024-05-14
3. Modified2024-08-02
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-34716 is to immediately upgrade PrestaShop to version 8.1.6 or later. This version includes a patch that addresses the underlying vulnerability. If upgrading is not immediately feasible, consider disabling the customer-thread feature flag through the front-office contact form to remove the attack vector. While not a complete solution, implementing a Web Application Firewall (WAF) with rules to detect and block suspicious file uploads, particularly those containing JavaScript code, can provide an additional layer of defense. Regularly review PrestaShop's security recommendations and apply any relevant configuration changes to harden the platform.