Multiple stored XSS via unprotected back-office template variables p3

An attacker who can inject data into the database either through limited back-office access or by chaining an existing vulnerability such as SQL injection can exploit unescaped variables in back-office templates to execute arbitrary JavaScript within an authenticated administrator's session.

The fix escapes HTML output across dozens of legacy Smarty (.tpl) and modern Twig (.html.twig) back-office templates, including group names, category paths, customer thread and message content, shop names, translation modules, and the admin login page. It also hardens the translation pipeline by introducing a dedicated HTMLPurifier-backed Twig extension (RawPurifiedExtension), wired through TranslationService and the Symfony service container.

This vulnerability affects the following application versions:

• PrestaShop 1.6.0.1



• PrestaShop 1.6.0.1 alpha 1



• PrestaShop 1.6.0.2



• PrestaShop 1.6.0.2 alpha 2



• PrestaShop 1.6.0.3



• PrestaShop 1.6.0.3 beta 1



• PrestaShop 1.6.0.4



• PrestaShop 1.6.0.4 RC1



• PrestaShop 1.6.0.5



• PrestaShop 1.6.0.6



• PrestaShop 1.6.0.7



• PrestaShop 1.6.0.8



• PrestaShop 1.6.0.9



• PrestaShop 1.6.0.10



• PrestaShop 1.6.0.11



• PrestaShop 1.6.0.12



• PrestaShop 1.6.0.13



• PrestaShop 1.6.0.14



• PrestaShop 1.6.1.0



• PrestaShop 1.6.1.0 RC4



• PrestaShop 1.6.1.0 RC5



• PrestaShop 1.6.1.1



• PrestaShop 1.6.1.1 RC1



• PrestaShop 1.6.1.1 RC2



• PrestaShop 1.6.1.2



• PrestaShop 1.6.1.2 RC1



• PrestaShop 1.6.1.2 RC2



• PrestaShop 1.6.1.2 RC3



• PrestaShop 1.6.1.2 RC4



• PrestaShop 1.6.1.3



• PrestaShop 1.6.1.3 RC1



• PrestaShop 1.6.1.4



• PrestaShop 1.6.1.5



• PrestaShop 1.6.1.6



• PrestaShop 1.6.1.7



• PrestaShop 1.6.1.8



• PrestaShop 1.6.1.9



• PrestaShop 1.6.1.10



• PrestaShop 1.6.1.11



• PrestaShop 1.6.1.11 beta 1



• PrestaShop 1.6.1.11-beta.1.0



• PrestaShop 1.6.1.12



• PrestaShop 1.6.1.13



• PrestaShop 1.6.1.14



• PrestaShop 1.6.1.15



• PrestaShop 1.6.1.16



• PrestaShop 1.6.1.17



• PrestaShop 1.6.1.18



• PrestaShop 1.6.1.19



• PrestaShop 1.6.1.20



• PrestaShop 1.6.1.21



• PrestaShop 1.6.1.22



• PrestaShop 1.6.1.23



• PrestaShop 1.6.1.24



• PrestaShop 1.7.0.0



• PrestaShop 1.7.0.0 alpha3



• PrestaShop 1.7.0.0 alpha4



• PrestaShop 1.7.0.0 beta1



• PrestaShop 1.7.0.0 beta2



• PrestaShop 1.7.0.0 beta3



• PrestaShop 1.7.0.0 RC0



• PrestaShop 1.7.0.0 RC1



• PrestaShop 1.7.0.0 RC2



• PrestaShop 1.7.0.0 RC3



• PrestaShop 1.7.0.1



• PrestaShop 1.7.0.2



• PrestaShop 1.7.0.3



• PrestaShop 1.7.0.4



• PrestaShop 1.7.0.5



• PrestaShop 1.7.0.6



• PrestaShop 1.7.1.0



• PrestaShop 1.7.1.0 beta1



• PrestaShop 1.7.1.1



• PrestaShop 1.7.1.2



• PrestaShop 1.7.2.0



• PrestaShop 1.7.2.0 RC 1



• PrestaShop 1.7.2.0-RC.1.0



• PrestaShop 1.7.2.1



• PrestaShop 1.7.2.2



• PrestaShop 1.7.2.3



• PrestaShop 1.7.2.4



• PrestaShop 1.7.2.5



• PrestaShop 1.7.3.0



• PrestaShop 1.7.3.0 beta 1



• PrestaShop 1.7.3.0 RC 1



• PrestaShop 1.7.3.1



• PrestaShop 1.7.3.2



• PrestaShop 1.7.3.3



• PrestaShop 1.7.3.4



• PrestaShop 1.7.4.0



• PrestaShop 1.7.4.0 beta 1



• PrestaShop 1.7.4.1



• PrestaShop 1.7.4.2



• PrestaShop 1.7.4.3



• PrestaShop 1.7.4.4



• PrestaShop 1.7.5.0



• PrestaShop 1.7.5.0 beta 1



• PrestaShop 1.7.5.0 RC 1



• PrestaShop 1.7.5.0-beta.1



• PrestaShop 1.7.5.0-RC.1



• PrestaShop 1.7.5.1



• PrestaShop 1.7.5.2



• PrestaShop 1.7.6.0



• PrestaShop 1.7.6.0 beta 1



• PrestaShop 1.7.6.0 RC 1



• PrestaShop 1.7.6.0 RC 2



• PrestaShop 1.7.6.0-beta.1



• PrestaShop 1.7.6.0-RC.1



• PrestaShop 1.7.6.0-RC.2



• PrestaShop 1.7.6.1



• PrestaShop 1.7.6.2



• PrestaShop 1.7.6.3



• PrestaShop 1.7.6.4



• PrestaShop 1.7.6.4 1



• PrestaShop 1.7.6.5



• PrestaShop 1.7.6.5 1



• PrestaShop 1.7.6.6



• PrestaShop 1.7.6.7



• PrestaShop 1.7.6.8



• PrestaShop 1.7.6.9



• PrestaShop 1.7.7.0



• PrestaShop 1.7.7.0 beta 1



• PrestaShop 1.7.7.0 beta 2



• PrestaShop 1.7.7.0 RC 1



• PrestaShop 1.7.7.0-beta.1



• PrestaShop 1.7.7.0-beta.2



• PrestaShop 1.7.7.0-RC.1



• PrestaShop 1.7.7.1



• PrestaShop 1.7.7.2



• PrestaShop 1.7.7.3



• PrestaShop 1.7.7.4



• PrestaShop 1.7.7.5



• PrestaShop 1.7.7.6



• PrestaShop 1.7.7.7



• PrestaShop 1.7.7.8



• PrestaShop 1.7.7.8 1



• PrestaShop 1.7.8.0



• PrestaShop 1.7.8.0 beta 1



• PrestaShop 1.7.8.0 1



• PrestaShop 1.7.8.0 RC 1



• PrestaShop 1.7.8.0-beta.1



• PrestaShop 1.7.8.0-RC.1



• PrestaShop 1.7.8.1



• PrestaShop 1.7.8.2



• PrestaShop 1.7.8.2 1



• PrestaShop 1.7.8.3



• PrestaShop 1.7.8.4



• PrestaShop 1.7.8.5



• PrestaShop 1.7.8.6



• PrestaShop 1.7.8.7



• PrestaShop 1.7.8.7 1



• PrestaShop 1.7.8.8



• PrestaShop 1.7.8.9



• PrestaShop 1.7.8.10



• PrestaShop 1.7.8.11



• PrestaShop 8.0.0



• PrestaShop 8.0.1



• PrestaShop 8.0.2



• PrestaShop 8.0.3



• PrestaShop 8.0.4



• PrestaShop 8.0.5



• PrestaShop 8.1.0



• PrestaShop 8.1.1



• PrestaShop 8.1.2



• PrestaShop 8.1.3



• PrestaShop 8.1.4



• PrestaShop 8.1.5



• PrestaShop 8.1.6



• PrestaShop 8.1.7



• PrestaShop 8.2.0



• PrestaShop 8.2.1



• PrestaShop 8.2.2



• PrestaShop 8.2.3



• PrestaShop 8.2.4



• PrestaShop 9.0.0



• PrestaShop 9.0.0-1.0-RC.1



• PrestaShop 9.0.1



• PrestaShop 9.0.1-1.0



• PrestaShop 9.0.2



• PrestaShop 9.0.2-2.0



• PrestaShop 9.0.3



• PrestaShop 9.0.3-3.0



• PrestaShop 9.1.0-3.0-beta.1



• PrestaShop 9.1.0-4.0-RC.1