CVE-2025-24027: PrestaShop ps_contactinfo Module XSS Flaw

CVE-2025-24027 Overview

The ps_contactinfo module for PrestaShop contains a stored cross-site scripting (XSS) vulnerability [CWE-79] affecting versions up to and including 3.3.2. The module displays store contact information and renders formatted address data without sufficient HTML sanitization. A fresh PrestaShop install is not directly exploitable. However, if a third-party module introduces a SQL injection or otherwise allows attacker-controlled data into the address tables, ps_contactinfo will render that stored payload as executable script in the browser context of site visitors and administrators.

Critical Impact
Attackers who can write to address fields through a vulnerable third-party module can execute arbitrary JavaScript in the storefront, enabling session theft, administrative account takeover, and merchant data compromise.

Affected Products

PrestaShop ps_contactinfo module versions <= 3.3.2
PrestaShop storefronts using vulnerable third-party modules that allow database writes to address records
Any deployment rendering formatted addresses from untrusted database content

Discovery Timeline

2025-01-22 - CVE-2025-24027 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24027

Vulnerability Analysis

The vulnerability resides in the getWidgetVariables() method of ps_contactinfo.php. The module calls AddressFormat::generateAddress() on the shop address and passes the raw result into the template under the formatted key. Because generateAddress() returns HTML that may include attacker-controlled address fields, any script content stored in those fields is rendered without escaping when the widget hooks into storefront templates.

Exploitation requires an attacker to first inject a payload into the address record. This is a chained attack: a separate weakness, such as a SQL injection in a third-party module, must place the malicious HTML into the database. Once stored, the payload executes whenever a page includes the contact info widget, reaching every visitor and back-office user viewing the affected screens.

Root Cause

The module trusted the output of AddressFormat::generateAddress() as safe HTML. Address components such as address1, address2, and city are user-supplied fields that pass through formatting without validation against a clean-HTML policy before being emitted into the DOM.

Attack Vector

The attack path is network-based but requires elevated preconditions. An attacker needs a companion vulnerability to write to the address tables, then simply waits for the stored payload to render. The high attack complexity and privilege requirements reflect this dependency on a separate flaw in a third-party module.

php

     public function getWidgetVariables($hookName = null, array $configuration = [])
     {
         $address = $this->context->shop->getAddress();
+        $formattedAddress = AddressFormat::generateAddress($address, [], '<br />');
 
         $is_state_multilang = !empty(State::$definition['multilang']);
         $state_name = (new State($address->id_state))->name;
 
         $contact_infos = [
             'company' => Configuration::get('PS_SHOP_NAME'),
             'address' => [
-                'formatted' => AddressFormat::generateAddress($address, [], '<br />'),
+                'formatted' => Validate::isCleanHtml($formattedAddress) ? $formattedAddress : '',
                 'address1' => $address->address1,
                 'address2' => $address->address2,
                 'postcode' => $address->postcode,

Source: PrestaShop ps_contactinfo commit d60f9a5. The patch wraps the formatted address in a Validate::isCleanHtml() check and substitutes an empty string when the content fails validation.

Detection Methods for CVE-2025-24027

Indicators of Compromise

Address records in the ps_address table containing HTML tags such as <script>, <img onerror=...>, or javascript: URIs
Outbound requests from storefront pages to unknown domains carrying cookie or session data
Unexpected creation of administrator accounts or configuration changes shortly after a visitor session
Web server logs showing SQL injection probes against third-party module endpoints preceding suspicious address writes

Detection Strategies

Audit all rows in the address tables for HTML control characters and script-like content using database queries
Enable Content Security Policy (CSP) reporting to surface inline script executions originating from storefront pages
Review the installed ps_contactinfo module version and flag any deployment at 3.3.2 or earlier
Correlate third-party module vulnerabilities disclosed in the PrestaShop marketplace with recent address-record modifications

Monitoring Recommendations

Log and alert on any modification to shop address records made outside of normal back-office workflows
Monitor front-end error telemetry for CSP violations tied to the contact info widget hooks
Track file integrity for modules/ps_contactinfo/ to confirm the patched version is deployed

How to Mitigate CVE-2025-24027

Immediate Actions Required

Upgrade the ps_contactinfo module to version 3.3.3 or later as soon as it is available
Inventory all third-party modules and remove or patch any with known SQL injection or input validation weaknesses
Sanitize existing address records by stripping HTML from address1, address2, city, and related fields
Rotate administrator sessions and credentials if stored payloads are found in the database

Patch Information

The fix is delivered in commit d60f9a5634b4fc2d3a8831fb08fe2e1f23cbfa39 and ships in ps_contactinfo version 3.3.3. The patch validates the output of AddressFormat::generateAddress() with Validate::isCleanHtml() before rendering. Full details are available in the GitHub Security Advisory GHSA-35pq-7pv2-2rfw.

Workarounds

No workarounds exist aside from applying the fix
Keep all installed modules maintained and updated to reduce the chance of a chained SQL injection
Restrict back-office access to trusted networks to limit exposure of any stored payload to administrators

bash

# Verify the installed module version
grep -R "version" modules/ps_contactinfo/ps_contactinfo.php | head -n 5

# Audit address records for HTML/script content
mysql -e "SELECT id_address, address1, address2, city FROM ps_address \
  WHERE address1 REGEXP '<|javascript:' \
     OR address2 REGEXP '<|javascript:' \
     OR city REGEXP '<|javascript:';"