CVE-2024-34716

CRITICAL

PrestaShop 8.1.0-8.1.6 - Stored Cross-Site Scripting via Customer Thread Attachment

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 5 public exploits for CVE-2024-34716. PoCs published by aelmokhtar, Eggzy, 0xDTC.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2024-34716, targeting PrestaShop 8.1.5. The exploit leverages a PNG file upload vulnerability to achieve remote code execution via a reverse shell.

Description

PrestaShop is an open source e-commerce web application. A cross-site scripting (XSS) vulnerability that only affects PrestaShops with customer-thread feature flag enabled is present starting from PrestaShop 8.1.0 and prior to PrestaShop 8.1.6. When the customer thread feature flag is enabled through the front-office contact form, a hacker can upload a malicious file containing an XSS that will be executed when an admin opens the attached file in back office. The script injected can access the session and the security token, which allows it to perform any authenticated action in the scope of the administrator's right. This vulnerability is patched in 8.1.6. A workaround is to disable the customer-thread feature-flag.

Exploits (5)

nomisec WORKING POC 15 stars
by aelmokhtar · poc
https://github.com/aelmokhtar/CVE-2024-34716

This repository contains a functional exploit for CVE-2024-34716, targeting PrestaShop 8.1.5. The exploit leverages a PNG file upload vulnerability to achieve remote code execution via a reverse shell.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: PrestaShop 8.1.5
No auth needed
Prerequisites: Access to the PrestaShop contact form · Admin email address · Local IP for reverse shell
devstral-2 · analyzed Feb 18, 2026 Full analysis →
gitlab WORKING POC 1 stars
by Eggzy · poc
https://gitlab.com/Eggzy/prestashop-cve-2024-34716

This repository contains a functional exploit for CVE-2024-34716, targeting PrestaShop 8.1.5. The exploit automates the process of embedding a reverse shell in a theme file and leverages an XSS vulnerability to achieve remote code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: PrestaShop 8.1.5
No auth needed
Prerequisites: Attacker-controlled server to host exploit files · Netcat listener for reverse shell · Valid email address registered on the target PrestaShop instance
devstral-2 · analyzed Feb 23, 2026 Full analysis →
nomisec SUSPICIOUS 1 stars
by 0xDTC · poc
https://github.com/0xDTC/Prestashop-CVE-2024-34716

The repository claims to exploit CVE-2024-34716 via CSRF and reverse shell but lacks actual exploit code, instead directing users to external resources and containing vague marketing language. The README is a sales pitch rather than technical analysis.

Classification
Suspicious 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Theoretical
Target: PrestaShop
Auth required
Prerequisites: Admin endpoint access · Admin email · Attacker-controlled IP
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP
by Pallangyo98 · poc
https://github.com/Pallangyo98/Trickster-HTB

This repository provides a detailed technical writeup of exploiting CVE-2024-34716 (PrestaShop XSS) as part of a multi-step attack chain on the Trickster HTB machine. It includes root cause analysis, exploitation steps, and privilege escalation techniques.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Moderate
Reliability
Reliable
Target: PrestaShop (with customer-thread feature flag enabled)
No auth needed
Prerequisites: PrestaShop instance with customer-thread feature enabled · Access to inject malicious scripts
devstral-2 · analyzed Apr 24, 2026 Full analysis →
nomisec WRITEUP
by TU-M · poc
https://github.com/TU-M/Trickster-HTB

This repository provides a detailed technical writeup of exploiting CVE-2024-34716 (PrestaShop XSS) as part of a multi-stage attack chain on the Trickster HTB machine. It includes steps for privilege escalation via SSTI and local exploits but lacks actual exploit code.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Moderate
Reliability
Theoretical
Target: PrestaShop (version not specified)
No auth needed
Prerequisites: PrestaShop with customer-thread feature enabled · Access to admin session tokens
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 9.6
EPSS 0.4232
EPSS Percentile 97.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-79
Status published
Products (2)
prestashop/prestashop 8.1.0 - 8.1.6
prestashop/prestashop 8.1.0 - 8.1.6Packagist
Published May 14, 2024
Tracked Since Feb 18, 2026