{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/385711#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nPrestaShop's back-office Performance > Debug mode functionality contains a PHP code injection vulnerability. An authenticated attacker with permission to modify debug-mode configuration can submit crafted cookie configuration values that are written into an executable PHP configuration file. Successful exploitation could allow arbitrary code execution with the privileges of the PHP process.\r\n\r\n### Description\r\nPrestaShop is an open-source e-commerce platform for creating and managing online stores. Its back-office Performance configuration includes a Debug mode for developers, which is enabled based on a specified cookie name and value.\r\n\r\nPrestaShop's debug-mode configuration code inserts the user-controlled values `debug_cookie_name` and `debug_cookie_value` into a PHP expression without adequately escaping or sanitizing them for use in PHP source code. The application writes this expression into the PHP `define()` statement in `config/defines.inc.php` or `config/defines_custom.inc.php`. A crafted value can terminate the intended string and introduce attacker-controlled PHP statements. The modified configuration file is loaded during application initialization, causing the injected code to execute on a subsequent request.\r\n\r\nExploitation requires an authenticated back-office account with permission to modify debug mode settings and a configuration file writable by the PHP process. Root or operating-system administrator privileges are not required. Cross-site request forgery (CSRF) protection helps prevent unauthorized requests made through another user's session, but does not prevent exploitation by an attacker controlling an account with the required permissions. Injected code executes with the privileges of the PHP process. Affected release versions remain to be confirmed.\r\n\r\n### Impact\r\nAn authenticated attacker with the required configuration permissions could execute arbitrary PHP code in the security context of the PHP process. This could allow access to application secrets and customer data, modification or deletion of application files and database contents, and disruption of store operations. Operating-system command execution depends on the PHP configuration and available functions. The vulnerability does not independently grant root privileges.\r\n\r\n### Solution\r\nPrestaShop version 9.2.1 addresses this vulnerability. Administrators should upgrade affected installations to version 9.2.1 or later.\r\nIf an immediate upgrade is not possible, allow only trusted administrators to modify Performance and Debug mode settings, and restrict network access to the back office. Where operationally feasible, prevent the PHP process from writing to config/defines.inc.php and config/defines_custom.inc.php. This may also prevent legitimate configuration changes.\r\n\r\n### Acknowledgements\r\nThanks to Deflask13 for reporting this vulnerability. This document was written by Michael Bragg.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/385711"},{"url":"https://prestashop.com/","summary":"https://prestashop.com/"}],"title":"PrestaShop Performance Debug Configuration Contains a PHP Code Injection Vulnerability","tracking":{"current_release_date":"2026-11-09T14:53:28+00:00","generator":{"engine":{"name":"VINCE","version":"4.0.2"}},"id":"VU#385711","initial_release_date":"2026-11-09 14:53:28.475139+00:00","revision_history":[{"date":"2026-11-09T14:53:28+00:00","number":"1.20261109145328.1","summary":"Released on 2026-11-09T14:53:28+00:00"}],"status":"final","version":"1.20261109145328.1"}},"vulnerabilities":[{"title":"PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration.","notes":[{"category":"summary","text":"PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted `debug_cookie_name` or `debug_cookie_value` that is written without sufficient escaping into a PHP configuration file. When PrestaShop subsequently loads the generated file, the injected PHP code is executed with the privileges of the web-server process."}],"cve":"CVE-2026-124916","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#385711"}]}],"product_tree":{"branches":[]}}