CVE-2024-34716

Deeper analysis

PrestaShop, an open source e-commerce web application, contains a stored cross-site scripting vulnerability (CWE-79) in versions 8.1.0 through 8.1.5. The flaw is present only when the customer-thread feature flag is enabled and manifests through the front-office contact form, allowing an attacker to upload a file containing malicious JavaScript that executes in the back-office context when an administrator views the attachment.

An unauthenticated attacker can exploit the issue by submitting a crafted file via the contact form. Once an administrator opens the file in the back office, the injected script gains access to the administrator’s session and security token, enabling arbitrary actions within the scope of the administrator’s privileges, including potential account takeover or further administrative operations.

Official advisories and release notes for PrestaShop 8.1.6 state that the vulnerability is resolved in that version. The recommended workaround for instances that cannot be immediately updated is to disable the customer-thread feature flag. The associated EPSS score remains elevated near 0.42 with no material post-disclosure climb from a low baseline.