Remote Code Execution (RCE)

2022-01-2803:31:40

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

remote code execution

prestashop

vulnerability

layoutextension.php

getlegacylayout

smarty

twig

arbitrary code execution

EPSS

0.003

Percentile

71.9%

JSON

prestashop/prestashop is vulnerable to remote code execution. The vulnerability exists in getLegacyLayout function of LayoutExtension.php due to improper escaping of smarty output for twig which allows an attacker to inject and execute arbitrary twig code.