2022 historical alert about a PrestaShop attack chain

This document keeps historical context. Do not apply the manual patches published during the alert today: the 2022 branches and mitigations have been superseded.

On 22 July 2022 PrestaShop warned of attacks that chained an SQL injection vulnerability with writing code through Smarty's MySQL cache.

Exploitation first required an SQL injection path. PrestaShop flagged a risk for shops from 1.6.0.10 onwards when the core, a module or custom code provided that path; version 1.7.8.2 or later was not to be considered vulnerable on its own without checking its modules and customisations. Later versions also hardened the affected cache.

What to do if a shop may have been exposed

1. Put it into maintenance mode and preserve files, database and logs before changing anything.
2. Identify the exact version, modules, theme and custom code. Migrate unsupported branches to a currently maintained version.
3. Review the whole account, not just config/smarty.config.inc.php: look for modified files, users, scheduled tasks, the database, credentials and other websites on the same hosting.
4. Set aside your findings in a reversible way and reinstall the core, modules and theme from official sources or known-good copies.
5. Close the entry point, rotate exposed credentials and verify the result with logs, integrity checks and functional tests.

Updating or removing the historical Smarty block does not prove that an already compromised shop is clean. Do not leave configuration copies or patches with predictable names inside a public directory.

When investigating, keep the context of each finding: path, date, version and relationship to the requests observed. A file with the same name as an indicator published in 2022 may be a clue, but its absence does not rule out an intrusion.

Prepare the update on an isolated copy and check orders, payments and tasks before reopening. Do not restore over a live shop without deciding how to preserve the transactions made after the backup.