Stored Cross-Site Scripting Vulnerability in Prestashop by PrestaShop SA
CVE-2025-1230

4.8MEDIUM

Key Information:

Vendor

Prestashop

Status
Prestashop
Vendor
CVE Published:
12 February 2025

What is CVE-2025-1230?

A stored Cross-Site Scripting (XSS) vulnerability exists in Prestashop 8.1.7 due to inadequate validation of user input via the '/<admin_directory>/index.php' interface. This flaw allows an attacker to craft a malicious query targeting authenticated users, potentially leading to the theft of session cookies and unauthorized access to user accounts. Remediation requires ensuring proper user input validation to safeguard against such exploits.

Affected Version(s)

Prestashop 8.1.7

References

https://www.incibe.es/en/incibe-cert/notices/aviso/cross-...

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

David Aparicio Salcedo
.