Exploitation Summary
EIP tracks 1 public exploit for CVE-2020-5250. PoCs published by drkbcn.
AI-analyzed exploit summary This repository contains a patching tool for CVE-2020-5250, a vulnerability in PrestaShop. It includes PHP scripts to detect and apply patches to affected files, but does not contain an actual exploit. The code is functional for patching but lacks offensive exploit capabilities.
Description
In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the id_address in the form, and thus steal someone else's address. It is the same with CustomerForm, you are able to change the id_customer and change all information of all accounts. The problem is patched in version 1.7.6.4.
Exploits (1)
This repository contains a patching tool for CVE-2020-5250, a vulnerability in PrestaShop. It includes PHP scripts to detect and apply patches to affected files, but does not contain an actual exploit. The code is functional for patching but lacks offensive exploit capabilities.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N