# PrestaShop debug-mode PHP injection flaw patched

Published: 2026-11-09 · Severity: routine · Sectors: Retail, Technology
Canonical: https://vorant.io/reports/7b52a15c-348e-5761-bac6-41d9991e15b3/prestashop-debug-mode-php-injection-flaw-patched
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> Authenticated PrestaShop back-office users can inject PHP code via debug-mode cookie settings, achieving arbitrary code execution; fixed in 9.2.1.

Source: kb.cert.org — https://kb.cert.org/vuls/id/385711

## What to check

- Applies to: The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT/CC published VU#385711 describing a PHP code injection vulnerability in PrestaShop's back-office Performance > Debug mode functionality. The debug-mode configuration accepts user-controlled values (debug_cookie_name and debug_cookie_value) that are inserted into a PHP define() statement written to config/defines.inc.php or config/defines_custom.inc.php without proper sanitization. An attacker with an authenticated back-office account holding permission to modify debug mode settings can craft values that terminate the intended string and inject arbitrary PHP statements, which execute on a subsequent request during application initialization.

Exploitation requires authenticated access with specific configuration permissions and a writable configuration file — root or OS-level privileges are not needed. CSRF protections do not mitigate this, since the attacker already controls a legitimate account with the required permissions. Successful exploitation grants code execution in the context of the PHP process, potentially exposing application secrets and customer data, enabling modification or deletion of files and database contents, and disrupting store operations. OS command execution is possible but depends on PHP configuration.

No in-the-wild exploitation has been reported. PrestaShop version 9.2.1 resolves the issue; administrators should upgrade immediately. Where upgrading is not immediately feasible, restrict Performance/Debug mode configuration permissions to trusted administrators only, limit back-office network access, and consider preventing the PHP process from writing to the affected configuration files (noting this may break legitimate configuration changes).

## Mentioned in this report

- Vulnerabilities: CVE-2026-124916

## Detection guidance (public sample)

### PrestaShop Debug Configuration File Modified

ATT&CK: T1505.003

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs linux file_event logs. Status: experimental. Generated from the report; not run against telemetry.

Write to PrestaShop config/defines.inc.php or defines_custom.inc.php, the files that receive the injected PHP in the debug-mode flaw (VU#385711). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PrestaShop Debug Configuration File Modified
id: 0d710121-1bb8-5b7d-9cca-447351092687
status: experimental
description: Detects writes to PrestaShop config/defines.inc.php or config/defines_custom.inc.php.
  The Performance > Debug mode PHP injection (VU#385711) places attacker-controlled
  debug_cookie_name/value into a define() statement in these files. Legitimate debug
  toggling also writes here, so correlate with back-office activity and review file
  content.
tags:
- attack.persistence
- attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|endswith:
    - /config/defines.inc.php
    - /config/defines_custom.inc.php
  condition: selection
falsepositives:
- Administrators legitimately toggling debug mode or profiling in the PrestaShop back
  office
- Deployment or upgrade scripts that regenerate PrestaShop configuration files
level: medium
author: Vorant
references:
- https://kb.cert.org/vuls/id/385711
```

### Web Server or PHP Process Spawning Shell With Recon or Download Commands

ATT&CK: T1059.004

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs linux process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

PHP/web server worker spawns a shell running recon, download or reverse-shell commands, as seen after PHP code injection yields OS command execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server or PHP Process Spawning Shell With Recon or Download Commands
id: 57c01400-e082-58e4-8612-c39f02c83cf0
status: experimental
description: Detects PHP-FPM, Apache or nginx worker processes spawning a shell that
  runs reconnaissance, download or reverse-shell commands. Injected PHP in PrestaShop
  config files (VU#385711) can reach OS command execution depending on PHP configuration.
tags:
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /php-fpm
    - /php-fpm7
    - /php-fpm8
    - /php
    - /apache2
    - /httpd
    - /nginx
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - whoami
    - /dev/tcp/
    - base64 -d
    - wget http
    - curl http
    - nc -e
    - /etc/passwd
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Web applications or admin panels that legitimately shell out to curl or wget for
  updates
- Authorized penetration testing against the web server
level: medium
author: Vorant
references:
- https://kb.cert.org/vuls/id/385711
```

### PrestaShop Debug Cookie Parameter With PHP Injection Characters

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs webserver logs. Status: experimental. Generated from the report; not run against telemetry.

Request to a PrestaShop endpoint carrying debug_cookie_name/value parameters with quote or statement-terminator characters, matching the VU#385711 injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PrestaShop Debug Cookie Parameter With PHP Injection Characters
id: d3823253-a8eb-514a-987e-05cf4b892b6a
status: experimental
description: Detects web requests whose query string includes the PrestaShop debug_cookie_name
  or debug_cookie_value parameters together with quote, statement terminator or PHP
  function-call characters, indicating an attempt to break out of the define() string
  (VU#385711). Only fires when the values are in the URL; POST bodies are not visible
  in standard web logs.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_param:
    cs-uri-query|contains:
    - debug_cookie_name
    - debug_cookie_value
  selection_inj:
    cs-uri-query|contains:
    - '%27'
    - '%3B'
    - ''');'
    - system(
    - eval(
    - '%29%3B'
  condition: selection_param and selection_inj
falsepositives:
- Security scanners sending generic injection payloads at all parameters
- Developers testing debug cookie parameters with unusual characters
level: medium
author: Vorant
references:
- https://kb.cert.org/vuls/id/385711
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/385711

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/7b52a15c-348e-5761-bac6-41d9991e15b3/prestashop-debug-mode-php-injection-flaw-patched.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup