CVE-2025-61924: PrestaShop Checkout Target PayPal merchant account hijacking from backoffice

The security advisory GHSA-wvpg-4wrh-5889 describes a validation bypass due to the wrong usage of PHP's array_search() function. The analysis of the associated patch commit b8e141bba4910e69ec299dcf4b9205bbe95dd7b7 confirms this. The function PrestaShop\Module\PrestashopCheckout\Validator\BatchConfigurationValidator::validateAjaxBatchConfiguration used array_search() in a way that a return value of 0 (for the first element in the array) would be treated as false, thus bypassing a security check. This allowed an attacker to modify blacklisted configuration values, potentially leading to the hijacking of a PayPal merchant account.

In addition to this primary vulnerability, the same patch addresses a significant path traversal vulnerability. The functions AdminAjaxPrestashopCheckoutController::ajaxProcessGetLogs and AdminAjaxPrestashopCheckoutController::ajaxProcessDownloadLogs accepted a filename from user input without sufficient sanitization. This allowed an authenticated administrator to read or download arbitrary files from the server's filesystem by crafting a malicious path (e.g., ../../config/settings.inc.php). The PrestaShop\Module\PrestashopCheckout\Logger\LoggerFileReader::read function was the component that ultimately performed the file read operation and was hardened to prevent this.

Both vulnerabilities require administrator privileges to be exploited. The identified functions are the direct points where the vulnerabilities existed and would be present in a runtime profile during an exploit.