PrestaShop CVE-2025-25692

Exploitation requires that the target is running exactly PrestaShop 8.2.0 (other versions not confirmed). The attacker must be able to reach the vulnerable endpoint via an HTTP POST request - no authentication is indicated by the CVSS PR:N vector, meaning unauthenticated exploitation is possible against default deployments. A critical prerequisite is that the attacker must be able to deliver a PHAR-formatted file payload that PHP's runtime will deserialize; this typically requires either direct file upload capability or the ability to place a PHAR file at a path reachable via a phar:// URI (e.g., through a prior upload or remote file inclusion step). If the _getHeaders function does not accept raw file paths from POST data directly, attackers may need a staging step to position the malicious archive. PHP configurations that explicitly disable PHAR stream wrapper processing would block this vector. No special platform or non-default configuration is required beyond a standard PHP-based PrestaShop installation.

The official CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) contains a significant internal inconsistency: a PR:N/AV:N attack surface is rated C:L/I:L despite the stated capability of arbitrary code execution, which should yield C:H/I:H/A:H and a score near 9.8. This underscores that the NVD-assigned impact metrics likely do not reflect the true worst-case impact described. EPSS at 0.77% (51st percentile) signals low observed exploitation activity in telemetry, suggesting mass exploitation has not yet occurred. However, a public POC exists and no KEV listing is present, meaning exploitation remains opportunistic rather than confirmed widespread. SSVC signals: exploitation status is 'PoC published,' the attack is automatable (POST request with no prerequisites), and technical impact is 'total' if code execution is achievable. The combination of zero authentication requirement, network accessibility of typical storefronts, confirmed exploit code, and command injection severity makes this a genuine priority despite the misleadingly moderate official score.

An unauthenticated attacker sends a crafted HTTP POST request to an exposed PrestaShop 8.2.0 endpoint, embedding a phar:// URI in a parameter consumed by the _getHeaders function. PHP's stream wrapper transparently deserializes the malicious PHAR archive's manifest, firing a CWE-77 gadget chain that injects and executes an OS command under the web server process's privileges. A public PoC exists and documents this technique, enabling exploitation by low-skilled actors against unpatched storefronts.