PrestaShop में कई संग्रहीत क्रॉस-साइट स्क्रिप्टिंग (stored XSS) कमजोरियाँ असुरक्षित टेम्पलेट चर के माध्यम से मौजूद हैं
प्लेटफ़ॉर्म
php
घटक
prestashop/prestashop
में ठीक किया गया
9.0.1
8.2.6
9.1.0
CVE-2026-33673 describes multiple stored Cross-Site Scripting (XSS) vulnerabilities within the PrestaShop back office (BO). An attacker capable of injecting data into the database, either through limited back-office access or leveraging a pre-existing vulnerability, can exploit unprotected variables in back-office templates. This vulnerability impacts PrestaShop versions up to 9.1.0-rc.1 and is resolved in versions 8.2.5 and 9.1.0.
प्रभाव और हमले की स्थितियाँअनुवाद हो रहा है…
Successful exploitation of CVE-2026-33673 allows an attacker to inject arbitrary JavaScript code into the PrestaShop back office. This code can then be executed in the context of a user's browser, potentially leading to account takeover, data theft, or defacement of the website. The impact is particularly severe because the vulnerability requires only limited back-office access, meaning an attacker doesn't necessarily need full administrative privileges to exploit it. The ability to inject data into the database, even through a separate vulnerability, significantly expands the attack surface. This vulnerability shares similarities with other XSS vulnerabilities where user-supplied data is not properly sanitized before being rendered in a web page.
शोषण संदर्भअनुवाद हो रहा है…
CVE-2026-33673 was publicly disclosed on March 25, 2026. There are currently no known public proof-of-concept exploits available. The vulnerability is not listed on the CISA KEV catalog as of this writing. Given the XSS nature of the vulnerability and the potential for widespread impact, it is prudent to assume that attackers may actively seek to exploit it.
कौन जोखिम में हैअनुवाद हो रहा है…
PrestaShop installations running versions 9.1.0-rc.1 and earlier are at risk. This includes businesses using PrestaShop for e-commerce, particularly those with limited security expertise or those who have not implemented robust input validation practices. Shared hosting environments running PrestaShop are also at increased risk, as vulnerabilities in one installation could potentially impact others.
पहचान के चरणअनुवाद हो रहा है…
• php: Examine back-office templates for unprotected variables. Search for instances where user-supplied data is directly rendered without proper encoding.
find /path/to/prestashop/templates -name '*.tpl' -print0 | xargs -0 grep -i '{{(.*?)}}' • generic web: Monitor access logs for unusual POST requests to back-office endpoints. Look for patterns indicative of XSS payload injection.
grep -i 'script' /var/log/apache2/access.logहमले की समयरेखा
- Disclosure
disclosure
खतरा खुफिया
एक्सप्लॉइट स्थिति
EPSS
0.04% (11% शतमक)
CISA SSVC
CVSS वेक्टर
इन मेट्रिक्स का क्या मतलब है?
- Attack Vector
- नेटवर्क — इंटरनेट के माध्यम से दूरस्थ रूप से शोषण योग्य। कोई भौतिक या स्थानीय पहुंच आवश्यक नहीं।
- Attack Complexity
- उच्च — रेस कंडीशन, गैर-डिफ़ॉल्ट कॉन्फ़िगरेशन या विशिष्ट परिस्थितियों की आवश्यकता।
- Privileges Required
- उच्च — व्यवस्थापक या विशेषाधिकार प्राप्त खाते की आवश्यकता।
- User Interaction
- आवश्यक — पीड़ित को फ़ाइल खोलनी, लिंक पर क्लिक करना या पेज पर जाना होगा।
- Scope
- बदला हुआ — हमला कमज़ोर घटक से परे अन्य प्रणालियों तक फैल सकता है।
- Confidentiality
- उच्च — पूर्ण गोपनीयता हानि। हमलावर सभी डेटा पढ़ सकता है।
- Integrity
- उच्च — हमलावर कोई भी डेटा लिख, बदल या हटा सकता है।
- Availability
- उच्च — पूर्ण क्रैश या संसाधन समाप्ति। पूर्ण सेवा से इनकार।
प्रभावित सॉफ्टवेयर
पैकेज जानकारी
- अंतिम अपडेट
- 9.1.3हाल ही में
कमजोरी वर्गीकरण (CWE)
समयरेखा
- आरक्षित
- प्रकाशित
- संशोधित
- EPSS अद्यतन
शमन और वर्कअराउंडअनुवाद हो रहा है…
The primary mitigation for CVE-2026-33673 is to upgrade to PrestaShop version 9.1.0 or later, or version 8.2.5. Unfortunately, no specific workarounds are provided in the advisory. If upgrading is not immediately feasible, consider implementing strict input validation and output encoding on all user-supplied data within the back office. While not a direct mitigation, a Web Application Firewall (WAF) configured to detect and block XSS payloads could provide a layer of defense. Regular security audits and penetration testing are also recommended to identify and address potential vulnerabilities.
कैसे ठीक करेंअनुवाद हो रहा है…
Actualice PrestaShop a la versión 8.2.5 o 9.1.0, o a una versión posterior, para corregir las vulnerabilidades XSS almacenadas. No existen workarounds conocidos.
CVE सुरक्षा न्यूज़लेटर
भेद्यता विश्लेषण और गंभीर अलर्ट सीधे आपके ईमेल में।
अक्सर पूछे जाने वाले सवालअनुवाद हो रहा है…
What is CVE-2026-33673 — XSS in PrestaShop 9.1.0-rc.1?
CVE-2026-33673 is a stored Cross-Site Scripting (XSS) vulnerability affecting PrestaShop versions up to 9.1.0-rc.1. Attackers can inject malicious scripts into the back office, potentially leading to account takeover.
Am I affected by CVE-2026-33673 in PrestaShop 9.1.0-rc.1?
Yes, if you are running PrestaShop versions 9.1.0-rc.1 or earlier, you are vulnerable to this XSS vulnerability. Upgrade to version 9.1.0 or 8.2.5 to mitigate the risk.
How do I fix CVE-2026-33673 in PrestaShop 9.1.0-rc.1?
The recommended fix is to upgrade to PrestaShop version 9.1.0 or 8.2.5. No specific workarounds are provided.
Is CVE-2026-33673 being actively exploited?
As of now, there are no confirmed reports of active exploitation, but given the nature of the vulnerability, it's prudent to assume attackers may seek to exploit it.
Where can I find the official PrestaShop advisory for CVE-2026-33673?
Refer to the official PrestaShop security advisory for detailed information and updates regarding CVE-2026-33673.
क्या आपका प्रोजेक्ट प्रभावित है?
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।