PrestaShop debug-mode PHP injection flaw patched

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Authenticated PrestaShop back-office users can inject PHP code via debug-mode cookie settings, achieving arbitrary code execution; fixed in 9.2.1.

Sourcekb.cert.org — open the original

CERT/CC published VU#385711 describing a PHP code injection vulnerability in PrestaShop's back-office Performance > Debug mode functionality. The debug-mode configuration accepts user-controlled values (debug_cookie_name and debug_cookie_value) that are inserted into a PHP define() statement written to config/defines.inc.php or config/defines_custom.inc.php without proper sanitization. An attacker with an authenticated back-office account holding permission to modify debug mode settings can craft values that terminate the intended string and inject arbitrary PHP statements, which execute on a subsequent request during application initialization.

Exploitation requires authenticated access with specific configuration permissions and a writable configuration file — root or OS-level privileges are not needed. CSRF protections do not mitigate this, since the attacker already controls a legitimate account with the required permissions. Successful exploitation grants code execution in the context of the PHP process, potentially exposing application secrets and customer data, enabling modification or deletion of files and database contents, and disrupting store operations. OS command execution is possible but depends on PHP configuration.

No in-the-wild exploitation has been reported. PrestaShop version 9.2.1 resolves the issue; administrators should upgrade immediately. Where upgrading is not immediately feasible, restrict Performance/Debug mode configuration permissions to trusted administrators only, limit back-office network access, and consider preventing the PHP process from writing to the affected configuration files (noting this may break legitimate configuration changes).

title: PrestaShop Debug Configuration File Modified
id: 0d710121-1bb8-5b7d-9cca-447351092687
status: experimental
description: Detects writes to PrestaShop config/defines.inc.php or config/defines_custom.inc.php.
  The Performance > Debug mode PHP injection (VU#385711) places attacker-controlled
  debug_cookie_name/value into a define() statement in these files. Legitimate debug
  toggling also writes here, so correlate with back-office activity and review file
  content.
tags:
- attack.persistence
- attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|endswith:
    - /config/defines.inc.php
    - /config/defines_custom.inc.php
  condition: selection
falsepositives:
- Administrators legitimately toggling debug mode or profiling in the PrestaShop back
  office
- Deployment or upgrade scripts that regenerate PrestaShop configuration files
level: medium
author: Vorant
references:
- https://kb.cert.org/vuls/id/385711

title: Web Server or PHP Process Spawning Shell With Recon or Download Commands
id: 57c01400-e082-58e4-8612-c39f02c83cf0
status: experimental
description: Detects PHP-FPM, Apache or nginx worker processes spawning a shell that
  runs reconnaissance, download or reverse-shell commands. Injected PHP in PrestaShop
  config files (VU#385711) can reach OS command execution depending on PHP configuration.
tags:
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /php-fpm
    - /php-fpm7
    - /php-fpm8
    - /php
    - /apache2
    - /httpd
    - /nginx
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - whoami
    - /dev/tcp/
    - base64 -d
    - wget http
    - curl http
    - nc -e
    - /etc/passwd
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Web applications or admin panels that legitimately shell out to curl or wget for
  updates
- Authorized penetration testing against the web server
level: medium
author: Vorant
references:
- https://kb.cert.org/vuls/id/385711

title: PrestaShop Debug Cookie Parameter With PHP Injection Characters
id: d3823253-a8eb-514a-987e-05cf4b892b6a
status: experimental
description: Detects web requests whose query string includes the PrestaShop debug_cookie_name
  or debug_cookie_value parameters together with quote, statement terminator or PHP
  function-call characters, indicating an attempt to break out of the define() string
  (VU#385711). Only fires when the values are in the URL; POST bodies are not visible
  in standard web logs.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_param:
    cs-uri-query|contains:
    - debug_cookie_name
    - debug_cookie_value
  selection_inj:
    cs-uri-query|contains:
    - '%27'
    - '%3B'
    - ''');'
    - system(
    - eval(
    - '%29%3B'
  condition: selection_param and selection_inj
falsepositives:
- Security scanners sending generic injection payloads at all parameters
- Developers testing debug cookie parameters with unusual characters
level: medium
author: Vorant
references:
- https://kb.cert.org/vuls/id/385711

Source reporting: https://kb.cert.org/vuls/id/385711

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.