GitHub Advisoryadvisory · Packagist

GHSA-35pq-7pv2-2rfw ps_contactinfo has a potential XSS due to usage of the nofilter tag in template

MEDIUM Published 2025-01-22 Modified 2025-01-22 Official page ↗
Aliases
CVE-2025-24027
Ecosystem
Packagist
Packages
prestashop/ps_contactinfo
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:H
Weaknesses
CWE-79
Reviewed
2025-01-22

Affected packages

• Packagist prestashop/ps_contactinfo: < 3.3.3 → fixed in 3.3.3

Description

Impact This can not be exploited in a fresh install of PrestaShop, only shops made vulnerable by third party modules are concerned. For example, if your shop has a third party module vulnerable to SQL injections, then ps_contactinfo might execute a stored XSS in FO. Patches The long term fix is to have all your modules maintained and updated. The fix on ps_contactinfo will keep formatted addresses from displaying an xss stored in the database. Workarounds none References none

Related

Alias · CVE (1)

  • CVE-2025-24027 ps_contactinfo, a PrestaShop module for displaying store contact information, has a cross-site scripting (XSS) vulnerability in versions up… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References