CVE-2024-24302

CRITICAL

Prestalife Product Designer < 1.178.36 - Insecure Deserialization

Title source: rule

Description

An issue was discovered in Tunis Soft "Product Designer" (productdesigner) module for PrestaShop before version 1.178.36, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the postProcess() method.

References (1)

[Third Party Advisory] https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2024-02-29-productdesigner-502.md

View Writeup ZIP pw:eip

Scores

CVSS v3 9.8

EPSS 0.0159

EPSS Percentile 81.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-502

Status published

Affected Products (1)

prestalife/product_designer < 1.178.36

Timeline

Published Mar 03, 2024

Tracked Since Feb 18, 2026