Security News > 2022 > July > Hackers Exploit PrestaShop Zero-Day to Steal Payment Data from Online Stores
Malicious actors are exploiting a previously unknown security flaw in the open source PrestaShop e-commerce platform to inject malicious skimmer code designed to swipe sensitive information.
"Attackers have found a way to use a security vulnerability to carry out arbitrary code execution in servers running PrestaShop websites," the company noted in an advisory published on July 22.
PrestaShop is marketed as the leading open-source e-commerce solution in Europe and Latin America, used by nearly 300,000 online merchants worldwide.
The PrestaShop maintainers also said it found a zero-day flaw in its service that it said has been addressed in version 1.7.8.7, although they cautioned that "We cannot be sure that it's the only way for them to perform the attack."
"This security fix strengthens the MySQL Smarty cache storage against code injection attacks," PrestaShop noted.
"This legacy feature is maintained for backward compatibility reasons and will be removed from future PrestaShop versions."
News URL
https://thehackernews.com/2022/07/hackers-exploit-prestashop-zero-day-to.html
Related news
- Hackers exploit 52 zero-days on the first day of Pwn2Own Ireland (source)
- Lazarus hackers used fake DeFi game to exploit Google Chrome zero-day (source)
- Chinese hackers exploit Fortinet VPN zero-day to steal credentials (source)
- Iranian hackers now exploit Windows flaw to elevate privileges (source)
- North Korean ScarCruft Exploits Windows Zero-Day to Spread RokRAT Malware (source)
- Hackers Exploit Roundcube Webmail XSS Vulnerability to Steal Login Credentials (source)
- Hackers exploit Roundcube webmail flaw to steal email, credentials (source)
- Over 70 zero-day flaws get hackers $1 million at Pwn2Own Ireland (source)
- Hackers target critical zero-day vulnerability in PTZ cameras (source)
- Russian Hackers Exploit New NTLM Flaw to Deploy RAT Malware via Phishing Emails (source)