Description
PrestaShop before 8.2.9 and 9.2.1 contains a broken access control vulnerability that allows an authenticated Webservice API key holder to read and modify customer records belonging to any shop in a multi-shop installation. Attackers can exploit the missing record-level shop ownership check in shopHasRight() and saveEntityFromXml() to read sensitive customer data such as password hashes and secure keys, and change a customer's email and password via create, update, and delete requests, resulting in account takeover.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PrestaShop | PrestaShop | 0 <8.2.9 | — |
| PrestaShop | PrestaShop | 9.0.0 <9.2.1 | — |
References
- https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-hjwq-7qvv-qxj4
- https://github.com/PrestaShop/PrestaShop/releases/tag/9.2.1
- https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.9
- https://www.vulncheck.com/advisories/prestashop-webservice-api-authorization-bypass-via-id-shop-parameter