PrestaShop heeft meerdere opgeslagen XSS-kwetsbaarheden via onbeschermde Template variabelen

Successful exploitation of CVE-2026-33673 allows an attacker to inject arbitrary JavaScript code into the PrestaShop back office. This code can then be executed in the context of a user's browser, potentially leading to account takeover, data theft, or defacement of the website. The impact is particularly severe because the vulnerability requires only limited back-office access, meaning an attacker doesn't necessarily need full administrative privileges to exploit it. The ability to inject data into the database, even through a separate vulnerability, significantly expands the attack surface. This vulnerability shares similarities with other XSS vulnerabilities where user-supplied data is not properly sanitized before being rendered in a web page.

PrestaShop installations running versions 9.1.0-rc.1 and earlier are at risk. This includes businesses using PrestaShop for e-commerce, particularly those with limited security expertise or those who have not implemented robust input validation practices. Shared hosting environments running PrestaShop are also at increased risk, as vulnerabilities in one installation could potentially impact others.

• php: Examine back-office templates for unprotected variables. Search for instances where user-supplied data is directly rendered without proper encoding.

find /path/to/prestashop/templates -name '*.tpl' -print0 | xargs -0 grep -i '{{(.*?)}}' 

• generic web: Monitor access logs for unusual POST requests to back-office endpoints. Look for patterns indicative of XSS payload injection.

grep -i 'script' /var/log/apache2/access.log

1. 2026-03-25Disclosure

   disclosure

1. Gereserveerd2026-03-23
2. Gepubliceerd2026-03-25
3. Gewijzigd2026-03-30
4. EPSS bijgewerkt2026-04-03

The primary mitigation for CVE-2026-33673 is to upgrade to PrestaShop version 9.1.0 or later, or version 8.2.5. Unfortunately, no specific workarounds are provided in the advisory. If upgrading is not immediately feasible, consider implementing strict input validation and output encoding on all user-supplied data within the back office. While not a direct mitigation, a Web Application Firewall (WAF) configured to detect and block XSS payloads could provide a layer of defense. Regular security audits and penetration testing are also recommended to identify and address potential vulnerabilities.

Laatste update

9.1.3recent