Description

xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and content parameters in ajax.php. The input is stored in the database without HTML sanitization and rendered in Smarty templates without output escaping, resulting in Stored Cross-Site Scripting (XSS). When an administrator reviews comments in the back office, the payload executes with admin-level session context, leading to full store compromise.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-28T16:17:47.190Z",
  "pubdate": "2026-08-28T16:17:47.190Z",
  "executiveSummary": "The xipblog module for PrestaShop (version 2.0.1 and earlier) contains a critical Stored Cross-Site Scripting (XSS) vulnerability.\nThis flaw permits unauthenticated remote attackers to inject arbitrary JavaScript into the application via the ajax.php component.\nThe vulnerability arises from the lack of input sanitization on specific parameters, allowing malicious payloads to be persisted directly within the database.\nWhen an administrator accesses the back-office interface to review comments, the stored payload is rendered within the Smarty template engine without adequate output escaping.\nThe execution of this script occurs within the context of the administrator's active session, potentially leading to unauthorized administrative actions, sensitive data exfiltration, or complete compromise of the PrestaShop store.\nThis vulnerability represents a significant security risk, as it bridges the gap between unauthenticated public-facing inputs and administrative privilege escalation.",
  "technicalDetails": "The vulnerability originates in the ajax.php file of the xipblog module. The application fails to perform rigorous input validation or sanitization on the 'name' and 'content' parameters provided by users during the comment submission process.\nBecause the input is ingested and written directly to the database without processing, it acts as a persistent repository for malicious payloads. The absence of server-side sanitization allows an attacker to inject arbitrary HTML and JavaScript tags into the stored record.\nThe secondary failure occurs during the rendering phase within the administrative back-office interface. The application utilizes Smarty templates to display these comments, but fails to implement contextual output escaping. Consequently, when the administrative user views the comment management dashboard, the browser interprets the previously stored malicious JavaScript as legitimate script content, executing it immediately within the authenticated admin session.\nThe attack flow proceeds as follows: First, an unauthenticated attacker submits a crafted HTTP request to ajax.php containing a malicious payload disguised as comment data. The module processes this request and commits the un-sanitized payload into the backend database. Subsequently, an administrator logs into the PrestaShop back office and navigates to the xipblog comment moderation or review section. Upon loading the page, the server fetches the stored payload from the database and embeds it into the Smarty template. Finally, the victim's browser executes the script automatically, granting the attacker the ability to perform actions on behalf of the administrator, such as modifying store configurations, accessing customer data, or escalating privileges to achieve full system compromise.\nThe impact is severe due to the elevated privilege level of the victim. By leveraging the administrative session, the attacker effectively bypasses standard access control mechanisms, leveraging the victim's legitimate authentication token to execute administrative commands via the back-office API."
}