A PHP Object Injection vulnerability affects the PrestaShop module ps_facetedsearch.
The module rebuilds the selected search filters from the request URL. The value of a slider filter (price or weight) is taken from the URL without sufficient validation, then stored in an internal filter-block cache where it is serialized and later read back with a raw native unserialize().
By crafting that value, an attacker can smuggle a malicious serialized PHP object into the cache. When it is deserialized, a gadget chain writes an arbitrary PHP file inside the module directory, which is then used as a webshell to run commands on the server.
This vulnerability affects the following application versions:
- PrestaShop 1.7.6.0
- PrestaShop 1.7.6.0 RC 1
- PrestaShop 1.7.6.0 RC 2
- PrestaShop 1.7.6.0-RC.1
- PrestaShop 1.7.6.0-RC.2
- PrestaShop 1.7.6.1
- PrestaShop 1.7.6.2
- PrestaShop 1.7.6.3
- PrestaShop 1.7.6.4
- PrestaShop 1.7.6.4 1
- PrestaShop 1.7.6.5
- PrestaShop 1.7.6.5 1
- PrestaShop 1.7.6.6
- PrestaShop 1.7.6.7
- PrestaShop 1.7.6.8
- PrestaShop 1.7.6.9
- PrestaShop 1.7.7.0
- PrestaShop 1.7.7.0 beta 1
- PrestaShop 1.7.7.0 beta 2
- PrestaShop 1.7.7.0 RC 1
- PrestaShop 1.7.7.0-beta.1
- PrestaShop 1.7.7.0-beta.2
- PrestaShop 1.7.7.0-RC.1
- PrestaShop 1.7.7.1
- PrestaShop 1.7.7.2
- PrestaShop 1.7.7.3
- PrestaShop 1.7.7.4
- PrestaShop 1.7.7.5
- PrestaShop 1.7.7.6
- PrestaShop 1.7.7.7
- PrestaShop 1.7.7.8
- PrestaShop 1.7.7.8 1
- PrestaShop 1.7.8.0
- PrestaShop 1.7.8.0 beta 1
- PrestaShop 1.7.8.0 1
- PrestaShop 1.7.8.0 RC 1
- PrestaShop 1.7.8.0-beta.1
- PrestaShop 1.7.8.0-RC.1
- PrestaShop 1.7.8.1
- PrestaShop 1.7.8.2
- PrestaShop 1.7.8.2 1
- PrestaShop 1.7.8.4
- PrestaShop 1.7.8.5
- PrestaShop 1.7.8.6
- PrestaShop 1.7.8.7
- PrestaShop 1.7.8.7 1
- PrestaShop 1.7.8.8
- PrestaShop 1.7.8.9
- PrestaShop 1.7.8.10
- PrestaShop 1.7.8.11
- PrestaShop 8.0.1
- PrestaShop 8.0.2
- PrestaShop 8.0.4
- PrestaShop 8.1.0
- PrestaShop 8.1.1
- PrestaShop 8.1.2
- PrestaShop 8.1.3
- PrestaShop 8.1.7
- PrestaShop 8.2.0
- PrestaShop 8.2.1
- PrestaShop 8.2.2
- PrestaShop 8.2.5
- PrestaShop 8.2.6
- PrestaShop 9.0.0-1.0-RC.1
- PrestaShop 9.0.1-1.0
- PrestaShop 9.0.2-2.0
- PrestaShop 9.0.3-3.0
- PrestaShop 9.1.0-3.0-beta.1
- PrestaShop 9.1.0-4.0
- PrestaShop 9.1.0-4.0-RC.1
- PrestaShop 9.1.3-5.0
- PrestaShop Faceted Search 3.0.1
- PrestaShop Faceted Search 3.0.2
- PrestaShop Faceted Search 3.0.3
- PrestaShop Faceted Search 3.0.4
- PrestaShop Faceted Search 3.0.5
- PrestaShop Faceted Search 3.2.0
- PrestaShop Faceted Search 3.2.1
- PrestaShop Faceted Search 3.3.0
- PrestaShop Faceted Search 3.4.0
- PrestaShop Faceted Search 3.4.1
- PrestaShop Faceted Search 3.5.0
- PrestaShop Faceted Search 3.6.0
- PrestaShop Faceted Search 3.7.0
- PrestaShop Faceted Search 3.8.0
- PrestaShop Faceted Search 3.9.0
- PrestaShop Faceted Search 3.10.0
- PrestaShop Faceted Search 3.11.0
- PrestaShop Faceted Search 3.11.1
- PrestaShop Faceted Search 3.12.0
- PrestaShop Faceted Search 3.12.1
- PrestaShop Faceted Search 3.13.2
- PrestaShop Faceted Search 3.14.0
- PrestaShop Faceted Search 3.14.1
- PrestaShop Faceted Search 3.15.0
- PrestaShop Faceted Search 3.15.1
- PrestaShop Faceted Search 3.16.0
- PrestaShop Faceted Search 3.16.1
- PrestaShop Faceted Search 4.0.0
- PrestaShop Faceted Search 4.0.1
- PrestaShop Faceted Search 4.0.2
- PrestaShop Faceted Search 4.0.3