PrestaShop 9.2.1 fixes PHP code injection in back-office Debug mode

PrestaShop 9.2.1 fixes PHP code injection in back-office Debug mode

10 November 2026: PrestaShop 9.2.1 fixes a code injection flaw in its Performance and Debug mode settings that lets an authenticated back-office user run PHP on the server, CERT/CC says in note VU#385711. No CVE number is assigned in the note and exploitation is not reported, but any online shop that shares admin access with agencies or contractors should upgrade.

Not yet independently verified. CERT/CC's note carries no CVE number and says affected releases remain to be confirmed. We have not read an advisory from PrestaShop itself. We will update this when it can be confirmed, and remove this note.

How a cookie value becomes code

The Debug mode feature writes two user-controlled fields, debug_cookie_name and debug_cookie_value, into a PHP define() statement in config/defines.inc.php or config/defines_custom.inc.php. Neither is escaped. A crafted value closes the string and adds PHP of the attacker's choosing, which then executes on the next request with the privileges of the PHP process.

The attacker needs a back-office account allowed to change Debug mode settings, and the configuration file has to be writable by PHP. Root is not required. Whether the injected code can reach operating system commands depends on how PHP is configured on the host.

Why an admin-only bug still matters for a shop

It is easy to dismiss a flaw that needs a privileged login. On an e-commerce site the gap between admin and server is significant, because a compromised back-office account can already change prices but cannot, without something like this, plant a persistent card skimmer in the code itself. Stolen merchant credentials are a common starting point for exactly that kind of attack.

Access is also spread unusually widely. Shops routinely hand back-office logins to theme developers, module vendors and marketing agencies, and those accounts are often left in place after the work ends.

If the upgrade has to wait

CERT/CC offers three interim measures:

• allow only trusted administrators to change Performance and Debug mode settings
• restrict network access to the back office
• make the two configuration files non-writable by the PHP process, accepting that this may block legitimate configuration changes

The third step is the strongest, since it removes the mechanism outright, and it can be reversed for the moment when a settings change is needed. A look through the two files for anything beyond ordinary define() lines is a quick way to check whether the flaw has already been used.

The note says affected release versions remain to be confirmed, so a shop on any release older than 9.2.1 should assume it is included. Deflask13 reported the flaw and Michael Bragg wrote the note.

PrestaShop is in our catalogue, and our ecommerce software category lists six products.

Sources

• CERT/CC Vulnerability Note VU#385711, 9 November 2026