Q:

Prestashop hacked using simpleslideshow module

Our prestashop 1.4.5.1 has been hacked,
I found the following https://www.youtube.com/watch?v=HXbDNPh0aTc
I would like to know:
Any info about it or any other known exploit.
How to fix it
Which version are effected.
Thanks,

A:

It's just a badly written module and the exploit is known. It doesn't matter which version of Prestashop you use.
Source: https://www.prestashop.com/forums/topic/543471-vulnerability-in-the-modules-simpleslideshow-and-vtemslideshow/ 

uploadimage.php have no checking for the admin's session and for the file types:

<?php

$uploaddir = './slides/';
$uploadfile = normalize(preg_replace('/ /', '_', basename($_FILES['userfile']['name'])));

if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploaddir . $uploadfile)) {
  echo "success:".$uploadfile;
} else {
  echo "error";
}

...

And its not the only module to be problematic.
Major security issues with few modules and themes.

