PrestaShop Checkout vulnerabilities

PrestaShop Checkout versions starting from 1.3.0 and prior to 4.4.1 and 5.0.5 have missing validation on the Express Checkout feature, allowing silent login and account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.

PrestaShop Checkout (versions prior to 4.4.1 and 5.0.5) contains a vulnerability allowing hijacking of the target PayPal merchant account from the backoffice due to incorrect usage of the PHP array_search() function. The flaw is fixed in versions 4.4.1 and 5.0.5.

PrestaShop Checkout versions prior to 4.4.1 and 5.0.5 lack input validation in the backoffice, resulting in directory traversal and arbitrary file disclosure. Fixed in versions 4.4.1 and 5.0.5.