Deflask13

PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted `debug cookie name` or `debug cookie value` that is written without sufficient escaping into a PHP configuration file. When PrestaShop subsequently loads the generated file, the injected PHP code is executed with the privileges of the web-server process.

The endpoint 'https://api.deepai.org/change user email' accepts POST requests without Cross-Site Request Forgery (CSRF) protection. CSRF is a flaw that allows an attacker to induce a user to perform actions they did not intend to do. An attacker could trick an authenticated user into clicking a malicious link, enabling the attacker to change the user's email address and gain full control of the account.