AI analysis
Thelia v2.6.0, an open-source PHP e-commerce platform, ships Smarty templates (address.html and address-update.html) that fail to escape double quotes in the 'next' parameter, allowing reflected cross-site scripting. An attacker crafts a malicious link in which the 'next' parameter breaks out of the quoted HTML attribute context and injects JavaScript, which executes when an authenticated user (e.g., a logged-in customer) visits the link. Successful exploitation lets the attacker run script in the victim's session context, enabling session hijacking, account manipulation, or fraudulent actions on the storefront. Deployments of Thelia 2.6.0 are affected; the related CERT-FR advisory (VU#162329) covers multiple vulnerabilities in Thelia 2.6.0 and 2.6.1, so 2.6.1 may also be implicated. There is no known public proof of concept and no evidence of exploitation in the wild.
What to do: Upgrade Thelia to a release incorporating the fixes referenced in CERT advisory VU#162329 as soon as the vendor publishes it, and check whether your deployment runs 2.6.0 or 2.6.1. As an interim mitigation, patch the address.html and address-update.html templates to escape the 'next' parameter (e.g., HTML-encode quotes) and validate it against an expected URL whitelist. Enforce HttpOnly and Secure flags on session cookies and remind staff and customers not to follow unsolicited links to the address pages, since this limits the impact of any successful script injection.
Affected
| Thelia | 2.6.0 (confirmed in the CVE description); 2.6.1 may also be affected per related advisory VU#162329, which covers multiple flaws in 2.6.0 and 2.6.1 |
Estimated exposure
niche≈ low thousands of public storefronts (order of 1,000–5,000 self-hosted Thelia sites) — Thelia is a niche open-source e-commerce CMS with a small install base relative to PrestaShop/Magento/WooCommerce; public web-technology surveys typically fingerprint only a few thousand live Thelia storefronts, and no authoritative…
Description
Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting (XSS) when an authenticated user visits the malicious link containing attacker‑controlled JavaScript.