Hackers exploited PrestaShop zero-day to breach online stores

guest · Jul 25, 2022

July 25, 2022

Hackers are targeting websites using the PrestaShop platform, leveraging a previously unknown vulnerability chain to perform code execution and potentially steal customers' payment information.

The PrestaShop team issued an urgent warning last Friday, urging the admins of 300,000 shops using its software to review their security stance after cyberattacks were discovered targeting the platform.
Click to expand...

The attack appears to impact PrestaShop versions 1.6.0.10 or later and versions 1.7.8.2 or later if they run modules vulnerable to SQL injection, such as the Wishlist 2.0.0 to 2.1.0 module.
The actively exploited vulnerability is being tracked with the identifier CVE-2022-36408.
Click to expand...

The attack begins by targeting a module or an older platform version vulnerable to SQL injection exploits. PrestaShop's team has not determined where these flaws exist at this time and warned that the compromise might be caused by a third-party component too.

"We believe attackers are targeting shops using outdated software or modules, vulnerable third-party modules, or a yet-to-be-discovered vulnerability," explains the PrestaShop security advisory.
Finally, upgrade all used modules to the latest available version and apply the PrestaShop security update released today, version 1.7.8.7.
Click to expand...

PrestaShop: Major Security Vulnerability On PrestaShop Websites

Attackers have found a way to use a security vulnerability to carry out arbitrary code execution in servers running PrestaShop websites. For details, please read the entire article.
Click to expand...

Log in or Sign up

Hackers exploited PrestaShop zero-day to breach online stores

guest Guest

Log in or Sign up

Hackers exploited PrestaShop zero-day to breach online stores

guest Guest

Useful Searches