CVE-2024-34716
CRITICALPrestaShop 8.1.0-8.1.6 - Stored Cross-Site Scripting via Customer Thread Attachment
Title source: llmExploitation Summary
EIP tracks 5 public exploits for CVE-2024-34716. PoCs published by aelmokhtar, Eggzy, 0xDTC.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2024-34716, targeting PrestaShop 8.1.5. The exploit leverages a PNG file upload vulnerability to achieve remote code execution via a reverse shell.
Description
PrestaShop is an open source e-commerce web application. A cross-site scripting (XSS) vulnerability that only affects PrestaShops with customer-thread feature flag enabled is present starting from PrestaShop 8.1.0 and prior to PrestaShop 8.1.6. When the customer thread feature flag is enabled through the front-office contact form, a hacker can upload a malicious file containing an XSS that will be executed when an admin opens the attached file in back office. The script injected can access the session and the security token, which allows it to perform any authenticated action in the scope of the administrator's right. This vulnerability is patched in 8.1.6. A workaround is to disable the customer-thread feature-flag.
Exploits (5)
This repository contains a functional exploit for CVE-2024-34716, targeting PrestaShop 8.1.5. The exploit leverages a PNG file upload vulnerability to achieve remote code execution via a reverse shell.
This repository contains a functional exploit for CVE-2024-34716, targeting PrestaShop 8.1.5. The exploit automates the process of embedding a reverse shell in a theme file and leverages an XSS vulnerability to achieve remote code execution.
The repository claims to exploit CVE-2024-34716 via CSRF and reverse shell but lacks actual exploit code, instead directing users to external resources and containing vague marketing language. The README is a sales pitch rather than technical analysis.
This repository provides a detailed technical writeup of exploiting CVE-2024-34716 (PrestaShop XSS) as part of a multi-step attack chain on the Trickster HTB machine. It includes root cause analysis, exploitation steps, and privilege escalation techniques.
This repository provides a detailed technical writeup of exploiting CVE-2024-34716 (PrestaShop XSS) as part of a multi-stage attack chain on the Trickster HTB machine. It includes steps for privilege escalation via SSTI and local exploits but lacks actual exploit code.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H