Plataforma
php
Componente
prestashop
Corrigido em
8.1.8
CVE-2025-1230 describes a stored Cross-Site Scripting (XSS) vulnerability affecting Prestashop versions 8.1.7. This flaw arises from insufficient input validation within the /admin_directory/index.php file, specifically concerning the 'link' parameter. Successful exploitation could allow a malicious user to inject scripts, potentially compromising authenticated user sessions.
The primary impact of CVE-2025-1230 is the potential for attackers to execute arbitrary JavaScript code within the context of a victim's browser session. By crafting a malicious query and sending it to an authenticated user, an attacker can inject a script that steals the user's cookie session details. This stolen cookie can then be used to impersonate the victim, gaining unauthorized access to their Prestashop admin panel and potentially sensitive data. The blast radius extends to any user with an active session in the affected Prestashop instance, making it a significant security risk.
CVE-2025-1230 was publicly disclosed on 2025-02-12. There is currently no indication of active exploitation campaigns targeting this vulnerability. Public proof-of-concept (PoC) code is not widely available, but the ease of exploitation suggests it could be leveraged in future attacks. The vulnerability has not been added to the CISA KEV catalog at the time of writing.
Prestashop installations running version 8.1.7 are directly at risk. Shared hosting environments utilizing Prestashop are particularly vulnerable, as attackers may be able to exploit the vulnerability through other tenants on the same server. Administrators relying on default Prestashop configurations and lacking robust input validation practices are also at increased risk.
• php / web:
curl -I 'https://your-prestashop-site.com/admin_directory/index.php?link=<script>alert(1)</script>' | grep HTTP/1.1• php / web: Examine Prestashop access logs for requests to /admin_directory/index.php containing suspicious characters or script tags in the 'link' parameter.
• generic web: Use a vulnerability scanner to check for XSS vulnerabilities in the 'link' parameter of /admin_directory/index.php.
disclosure
Status do Exploit
EPSS
0.07% (percentil 22%)
CISA SSVC
Vetor CVSS
The recommended mitigation for CVE-2025-1230 is to immediately upgrade Prestashop to version 8.1.8, which includes the necessary fix for the input validation issue. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter requests containing suspicious characters or patterns in the 'link' parameter. Additionally, review and harden access controls to the /admin_directory/index.php file to limit potential attack vectors. After upgrade, confirm the vulnerability is resolved by attempting to inject a simple XSS payload via the 'link' parameter and verifying that it is properly sanitized.
Actualice Prestashop a una versión posterior a la 8.1.7 para corregir la vulnerabilidad XSS. Esto evitará que usuarios no autorizados ejecuten scripts maliciosos en el contexto de otros usuarios autenticados. Consulte el sitio web oficial de Prestashop para obtener instrucciones detalladas sobre cómo realizar la actualización.
Análise de vulnerabilidades e alertas críticos diretamente no seu e-mail.
CVE-2025-1230 is a stored Cross-Site Scripting (XSS) vulnerability in Prestashop version 8.1.7, allowing attackers to inject malicious scripts through the 'link' parameter in the admin panel.
Yes, if you are running Prestashop version 8.1.7, you are vulnerable to this XSS attack. Upgrade to 8.1.8 to mitigate the risk.
The recommended fix is to upgrade Prestashop to version 8.1.8. As a temporary workaround, implement a WAF rule to filter suspicious requests.
There is currently no confirmed evidence of active exploitation, but the vulnerability's ease of exploitation suggests it could be targeted in the future.
Refer to the official Prestashop security advisory for CVE-2025-1230 on the Prestashop website (check their security announcements page).
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.