Platform
php
Component
prestashop
Fixed in
8.1.8
CVE-2025-1230 describes a stored Cross-Site Scripting (XSS) vulnerability affecting Prestashop versions 8.1.7. This flaw arises from insufficient input validation within the /admin_directory/index.php file, specifically concerning the 'link' parameter. Successful exploitation could allow a malicious user to inject scripts, potentially compromising authenticated user sessions.
The primary impact of CVE-2025-1230 is the potential for attackers to execute arbitrary JavaScript code within the context of a victim's browser session. By crafting a malicious query and sending it to an authenticated user, an attacker can inject a script that steals the user's cookie session details. This stolen cookie can then be used to impersonate the victim, gaining unauthorized access to their Prestashop admin panel and potentially sensitive data. The blast radius extends to any user with an active session in the affected Prestashop instance, making it a significant security risk.
CVE-2025-1230 was publicly disclosed on 2025-02-12. There is currently no indication of active exploitation campaigns targeting this vulnerability. Public proof-of-concept (PoC) code is not widely available, but the ease of exploitation suggests it could be leveraged in future attacks. The vulnerability has not been added to the CISA KEV catalog at the time of writing.
Exploit Status
EPSS
0.07% (22% percentile)
CISA SSVC
CVSS Vector
The recommended mitigation for CVE-2025-1230 is to immediately upgrade Prestashop to version 8.1.8, which includes the necessary fix for the input validation issue. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter requests containing suspicious characters or patterns in the 'link' parameter. Additionally, review and harden access controls to the /admin_directory/index.php file to limit potential attack vectors. After upgrade, confirm the vulnerability is resolved by attempting to inject a simple XSS payload via the 'link' parameter and verifying that it is properly sanitized.
Update Prestashop to a version later than 8.1.7 to fix the XSS vulnerability. This will prevent unauthorized users from executing malicious scripts in the context of other authenticated users. Refer to the official Prestashop website for detailed instructions on how to perform the update.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-1230 is a stored Cross-Site Scripting (XSS) vulnerability in Prestashop version 8.1.7, allowing attackers to inject malicious scripts through the 'link' parameter in the admin panel.
Yes, if you are running Prestashop version 8.1.7, you are vulnerable to this XSS attack. Upgrade to 8.1.8 to mitigate the risk.
The recommended fix is to upgrade Prestashop to version 8.1.8. As a temporary workaround, implement a WAF rule to filter suspicious requests.
There is currently no confirmed evidence of active exploitation, but the vulnerability's ease of exploitation suggests it could be targeted in the future.
Refer to the official Prestashop security advisory for CVE-2025-1230 on the Prestashop website (check their security announcements page).
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.