CVE-2025-61922
CRITICALPrestaShop Checkout 1.3.0-4.4.0 and 5.0.0-5.0.4 - Account Takeover via Express Checkout Email Validation Bypass
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2025-61922. PoCs published by g0vguy, captaincookie34.
AI-analyzed exploit summary This PoC exploits CVE-2025-61922, a zero-click account takeover vulnerability in PrestaShop Checkout < 5.0.5. It checks for vulnerability, performs the takeover by sending a crafted JSON payload, and tests the captured session cookies.
Description
PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent login, enabling account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.
Exploits (2)
This PoC exploits CVE-2025-61922, a zero-click account takeover vulnerability in PrestaShop Checkout < 5.0.5. It checks for vulnerability, performs the takeover by sending a crafted JSON payload, and tests the captured session cookies.
The repository contains only a README.md file describing a simulated PrestaShop vulnerability without any exploit code or technical details. It lacks actionable PoC or exploit implementation.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N