AI analysis
Thelia v2.6.0, an open-source PHP e-commerce platform, allows authenticated administrators to upload and install modules via a ZIP upload function without validating or sandboxing embedded PHP code. An attacker who has administrator credentials (or who compromises an admin account) can package malicious PHP code in a module's install() method, which executes on the web server when the module is installed, resulting in remote code execution with web-server privileges. This is a trusted-admin boundary issue rather than an unauthenticated flaw, so exploitation requires admin-level access to the back office. There is no known public PoC and no evidence of exploitation in the wild. It was reported alongside multiple other vulnerabilities in Thelia 2.6.0 and 2.6.1 (VU#162329).
What to do: Upgrade to the latest Thelia release (newer than 2.6.0/2.6.1) once a fix is available, and restrict back-office administrator accounts to trusted personnel with MFA enabled, since the flaw requires admin authentication. Audit the modules directory and server logs for any unexpected ZIP module installs or unknown PHP files, and consider disabling the module upload feature if it is not needed.
Estimated exposure
nichelikely on the order of a few thousand self-hosted Thelia shops, unknown precisely — Thelia is a self-hosted French-origin open-source e-commerce CMS with modest adoption compared to WordPress or PrestaShop, and no public active-install counts or internet-exposed scan figures for this platform were available, so this is a…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's `install()` method which will then be executed upon installation, enabling remote code execution with the privileges of the web server.