A PHP Object Injection vulnerability affects the PrestaShop module ps facetedsearch.

The module rebuilds the selected search filters from the request URL. The value of a slider filter (price or weight) is taken from the URL without sufficient validation, then stored in an internal filter-block cache where it is serialized and later read back with a raw native unserialize(). By crafting that value, an attacker can smuggle a malicious serialized PHP object into the cache. When it is deserialized, a gadget chain writes an arbitrary PHP file inside the module directory, which is then used as a webshell to run commands on the server.

Any shop using a vulnerable version of ps facetedsearch that displays a filter template containing a slider filter (price or weight). Exploitation is remote and unauthenticated, a single crafted front-office request is enough, and leads to remote code execution and full compromise of the shop and its server.

Affected versions: 3.0.0 through 4.0.3 (all versions since 3.0.0, including the latest release).

Upgrade the ps facetedsearch module to the patched version. Upgrading the module is the best action that removes the vulnerability.

Otherwise, you can apply the fix manually in the file src/Filters/Block.php:

In the getFromCache() method, replace the native unserialize() call:

// Before
if (!empty($row)) {
  return unserialize(current($row));
}

// After
if (!empty($row)) {
  return Tools::unSerialize(current($row));
}