Thelia Back Office Default Twig Template
Monthly
The Thelia back-office Twig template bundle (thelia/backoffice-default-twig-template) before 1.1.1 exposes two admin catalogue routes - /admin/product/combinations/update and /admin/product/default-price/update - that accept GET requests and perform no anti-CSRF token validation, even though the legitimate form already emits a token in its action URL and the fix later moves it into a hidden field that is actually checked. An attacker who lures a logged-in administrator into a top-level navigation (a clicked link or a meta-refresh/location redirect) can rewrite product combination price, sale price, weight, stock, EAN and onsale/isnew flags across many SKUs in a single request, and price fields omitted from the payload are written as zero, turning items into free products. The attacker needs no account or credentials, but exploitation is bounded by mandatory administrator interaction and by the SameSite=Lax session cookie, which permits top-level GET navigations while refusing subresource requests such as an <img src> or prefetcher hits that arrive without the session; the vendor advisory publishes step-by-step reproduction requests, and a public PoC reference therefore exists, though it is not verified as packaged working exploit code. No CISA KEV entry is recorded and the vuln.today priority label is this_month, consistent with a genuine but moderate integrity-only issue rather than an emergency.
Stored cross-site scripting in Thelia's back-office store configuration lets an authenticated administrator holding store update permission upload SVG logo or banner images whose event handlers and script content are stored intact, creating a persistent script implant on the shop origin. The same bytes execute against higher-privileged administrators at /admin/store-media/logo and against anonymous visitors, crawlers and link-preview fetchers via the image cache copy mirrored into the document root and advertised in every front-office page's og:image meta. The vendor fixed the flaw in Thelia 3.1.1 and back-office default-twig template 1.1.1, and the GitHub advisory carries a step-by-step PoC walkthrough, so a public PoC reference exists; it is not verified as working exploit code, and the issue is not confirmed actively exploited (CISA KEV).
Cross-site request forgery in Thelia's back office lets a crafted link or hostile page make a logged-in administrator delete, hide or reorder catalogue and configuration objects without any error or audit entry. All Thelia releases before 3.2.0 are affected: the single per-session CSRF token is rendered into URL query strings (so it leaks through access logs, browser history, HTTP Referer headers or any XSS on the admin domain), and the setToggleVisibilityAction and updatePositionAction routes inherited from AbstractCrudController performed state changes without any token check, making toggles and reordering exploitable as pure CSRF with no token theft at all. The attacker needs no privileges (CVSS PR:N) but exploitation requires a currently authenticated back-office administrator to actively click the link, since anonymous requests are redirected to /admin/login; a public proof-of-concept reference exists in the vendor advisory, it is not verified as working exploit code, and there is no indication of active exploitation at time of analysis.
The Thelia back-office Twig template bundle (thelia/backoffice-default-twig-template) before 1.1.1 exposes two admin catalogue routes - /admin/product/combinations/update and /admin/product/default-price/update - that accept GET requests and perform no anti-CSRF token validation, even though the legitimate form already emits a token in its action URL and the fix later moves it into a hidden field that is actually checked. An attacker who lures a logged-in administrator into a top-level navigation (a clicked link or a meta-refresh/location redirect) can rewrite product combination price, sale price, weight, stock, EAN and onsale/isnew flags across many SKUs in a single request, and price fields omitted from the payload are written as zero, turning items into free products. The attacker needs no account or credentials, but exploitation is bounded by mandatory administrator interaction and by the SameSite=Lax session cookie, which permits top-level GET navigations while refusing subresource requests such as an <img src> or prefetcher hits that arrive without the session; the vendor advisory publishes step-by-step reproduction requests, and a public PoC reference therefore exists, though it is not verified as packaged working exploit code. No CISA KEV entry is recorded and the vuln.today priority label is this_month, consistent with a genuine but moderate integrity-only issue rather than an emergency.
Stored cross-site scripting in Thelia's back-office store configuration lets an authenticated administrator holding store update permission upload SVG logo or banner images whose event handlers and script content are stored intact, creating a persistent script implant on the shop origin. The same bytes execute against higher-privileged administrators at /admin/store-media/logo and against anonymous visitors, crawlers and link-preview fetchers via the image cache copy mirrored into the document root and advertised in every front-office page's og:image meta. The vendor fixed the flaw in Thelia 3.1.1 and back-office default-twig template 1.1.1, and the GitHub advisory carries a step-by-step PoC walkthrough, so a public PoC reference exists; it is not verified as working exploit code, and the issue is not confirmed actively exploited (CISA KEV).
Cross-site request forgery in Thelia's back office lets a crafted link or hostile page make a logged-in administrator delete, hide or reorder catalogue and configuration objects without any error or audit entry. All Thelia releases before 3.2.0 are affected: the single per-session CSRF token is rendered into URL query strings (so it leaks through access logs, browser history, HTTP Referer headers or any XSS on the admin domain), and the setToggleVisibilityAction and updatePositionAction routes inherited from AbstractCrudController performed state changes without any token check, making toggles and reordering exploitable as pure CSRF with no token theft at all. The attacker needs no privileges (CVSS PR:N) but exploitation requires a currently authenticated back-office administrator to actively click the link, since anonymous requests are redirected to /admin/login; a public proof-of-concept reference exists in the vendor advisory, it is not verified as working exploit code, and there is no indication of active exploitation at time of analysis.