Critical 9.8 CVSS 3.1 Core Published on 2024-08-12

An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary code via the module upgrade functionality.

CVECVE-2024-41651 GHSANo GHSA advisory

View at the source View JSON Last modified at the source: 2026-06-17

Description

An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary code via the module upgrade functionality. NOTE: this is disputed by multiple parties, who report that exploitation requires that an attacker be able to hijack network requests made by an admin user (who, by design, is allowed to change the code that is running on the server).

Original text by NVD (NIST), public domain.

CVSS metrics 3.1

Source: nvd@nist.gov · primary

Critical 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vectorNetwork

ComplexityHigh

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

References

Exploitgithub.com
https://github.com/Fckroun/CVE-2024-41651/tree/main

Found a vulnerability?

Write to the PrestaShop core security team:

security-core@prestashop.com

Related advisories

Same component: PrestaShop core

All core advisories (94)

IDAdvisoryComponentSeverityAffected versionsPublishedFix

CVE-2026-84186 Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows… Core Medium 6.9 ≥ 8.0.0 < 8.2.8
≥ 9.0.0 < 9.1.5 2026-09-07 No

GHSA-jf3w-9rmr-5rcr Improper access control on the back-office notifications endpoint exposes customer data Core Medium 4.3 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes

GHSA-whxq-pxj5-qq7v SQL injection through back-office list filters Core Medium 6.5 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes

GHSA-2cr4-vw9p-pjvf Client IP address can be spoofed through the X-Forwarded-For header Core High 7.3 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes

Is your shop on 8.x ≤ 8.1.7?

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.

Check if my shop is affected