CVE-2018-20717

Vulnerability

The vulnerability resides in the orders section of PrestaShop versions before 1.7.2.5. The component fails to properly validate serialized objects within the request handling. The security check looks for a pattern of 0: followed by an integer, but it does not consider 0:+ followed by an integer, allowing an attacker to bypass the protection. This permits the injection of arbitrary PHP objects into the application process [1][3].

Exploitation

An attacker must first gain access to a target store with a user role having at least Salesman privileges or higher. With such access, they can craft a malicious serialized PHP object string using the 0:+ bypass pattern. By injecting this payload into the orders section workflow, the object is deserialized and executed within the application context [1][3].

Impact

Successful exploitation results in arbitrary PHP object injection and chaining, leading to Remote Code Execution (RCE). The attacker can execute arbitrary PHP code on the PrestaShop server, potentially leading to full compromise of the application and its data [1][3].

Mitigation

The issue is fixed in PrestaShop version 1.7.2.5 and later. Users should upgrade to the latest patched version immediately. There are no known workarounds for unpatched installations [1][2].