Thelia Core
Monthly
Stored cross-site scripting in Thelia before 3.1.0 lets anyone who self-registers a front-office customer account plant script in the customer name, which then executes in an administrator's browser on the back-office coupon screen when a 'For one or more customers' condition references that customer. Injection is effectively unauthenticated (CVSS PR:N) since registration validates firstname/lastname with NotBlank only, but execution is gated: an administrator must both attach that condition to a coupon and then load the coupon edit page or GET /admin/coupon/draw/conditionsSummaries/{couponId} (the AT:P and UI:A gates). From the admin origin the payload steals the in-page CSRF token and creates a new administrator account that resolves to super-admin; the vendor advisory publishes a staged proof-of-concept walkthrough, though it is not independently verified as working exploit code, and no active exploitation is confirmed (CISA KEV not listed). The vendor CVSS 4.0 score is 7.4 High, while our assessment lands on CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N, prioritised as this_week.
Stored cross-site scripting in Thelia's back-office store configuration lets an authenticated administrator holding store update permission upload SVG logo or banner images whose event handlers and script content are stored intact, creating a persistent script implant on the shop origin. The same bytes execute against higher-privileged administrators at /admin/store-media/logo and against anonymous visitors, crawlers and link-preview fetchers via the image cache copy mirrored into the document root and advertised in every front-office page's og:image meta. The vendor fixed the flaw in Thelia 3.1.1 and back-office default-twig template 1.1.1, and the GitHub advisory carries a step-by-step PoC walkthrough, so a public PoC reference exists; it is not verified as working exploit code, and the issue is not confirmed actively exploited (CISA KEV).
Cross-site request forgery in Thelia's back office lets a crafted link or hostile page make a logged-in administrator delete, hide or reorder catalogue and configuration objects without any error or audit entry. All Thelia releases before 3.2.0 are affected: the single per-session CSRF token is rendered into URL query strings (so it leaks through access logs, browser history, HTTP Referer headers or any XSS on the admin domain), and the setToggleVisibilityAction and updatePositionAction routes inherited from AbstractCrudController performed state changes without any token check, making toggles and reordering exploitable as pure CSRF with no token theft at all. The attacker needs no privileges (CVSS PR:N) but exploitation requires a currently authenticated back-office administrator to actively click the link, since anonymous requests are redirected to /admin/login; a public proof-of-concept reference exists in the vendor advisory, it is not verified as working exploit code, and there is no indication of active exploitation at time of analysis.
Stored cross-site scripting in Thelia before 3.1.0 lets anyone who self-registers a front-office customer account plant script in the customer name, which then executes in an administrator's browser on the back-office coupon screen when a 'For one or more customers' condition references that customer. Injection is effectively unauthenticated (CVSS PR:N) since registration validates firstname/lastname with NotBlank only, but execution is gated: an administrator must both attach that condition to a coupon and then load the coupon edit page or GET /admin/coupon/draw/conditionsSummaries/{couponId} (the AT:P and UI:A gates). From the admin origin the payload steals the in-page CSRF token and creates a new administrator account that resolves to super-admin; the vendor advisory publishes a staged proof-of-concept walkthrough, though it is not independently verified as working exploit code, and no active exploitation is confirmed (CISA KEV not listed). The vendor CVSS 4.0 score is 7.4 High, while our assessment lands on CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N, prioritised as this_week.
Stored cross-site scripting in Thelia's back-office store configuration lets an authenticated administrator holding store update permission upload SVG logo or banner images whose event handlers and script content are stored intact, creating a persistent script implant on the shop origin. The same bytes execute against higher-privileged administrators at /admin/store-media/logo and against anonymous visitors, crawlers and link-preview fetchers via the image cache copy mirrored into the document root and advertised in every front-office page's og:image meta. The vendor fixed the flaw in Thelia 3.1.1 and back-office default-twig template 1.1.1, and the GitHub advisory carries a step-by-step PoC walkthrough, so a public PoC reference exists; it is not verified as working exploit code, and the issue is not confirmed actively exploited (CISA KEV).
Cross-site request forgery in Thelia's back office lets a crafted link or hostile page make a logged-in administrator delete, hide or reorder catalogue and configuration objects without any error or audit entry. All Thelia releases before 3.2.0 are affected: the single per-session CSRF token is rendered into URL query strings (so it leaks through access logs, browser history, HTTP Referer headers or any XSS on the admin domain), and the setToggleVisibilityAction and updatePositionAction routes inherited from AbstractCrudController performed state changes without any token check, making toggles and reordering exploitable as pure CSRF with no token theft at all. The attacker needs no privileges (CVSS PR:N) but exploitation requires a currently authenticated back-office administrator to actively click the link, since anonymous requests are redirected to /admin/login; a public proof-of-concept reference exists in the vendor advisory, it is not verified as working exploit code, and there is no indication of active exploitation at time of analysis.