CVE-2024-24302

CRITICAL

Product Designer < 1.178.36 - Remote Code Execution via postProcess() Method

Title source: llm
STIX 2.1

Description

An issue was discovered in Tunis Soft "Product Designer" (productdesigner) module for PrestaShop before version 1.178.36, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the postProcess() method.

References (1)

Core 1

Scores

CVSS v3 9.8
EPSS 0.0093
EPSS Percentile 56.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-502
Status published
Products (1)
prestalife/product_designer < 1.178.36
Published Mar 03, 2024
Tracked Since Feb 18, 2026