PrestaShop Checkout Target PayPal Account Hijacking Vulnerability

A vulnerability in the PrestaShop Checkout payment module, affecting versions prior to 4.4.1 and 5.0.5, allows for Target PayPal merchant account hijacking from the back office. This issue arises from improper validation due to the incorrect use of the PHP array_search() function, enabling account takeover.

Impact

Exploitation of this vulnerability could lead to unauthorized access to and control over a Target PayPal merchant account, allowing for potentially fraudulent transactions or manipulation of account settings.

Remediation

Users can upgrade to PrestaShop Checkout version 4.4.1 for PrestaShop 1.7 or 8, or version 5.0.5 for PrestaShop 1.7, 8, or 9.