v1.6-v1.7-v8x /!\Security ALERT - PrestaHero Contact Form 7 - Version: 2.3.9 to 2.4.1 (latest)

[chibi]

Security Alert: PrestaShop Module "Contact Form 7" (ets_contactform7)

The "Contact Form 7" module (version 2.3.9 and even the latest official available version) available on this forum contains critical vulnerabilities that allow attackers to perform unauthorized actions, exfiltrate database data, and execute malicious code in administrators' browsers.

Key issues:

• Broken access control: Any authenticated back-office user with minimal rights can delete forms or modify configurations via crafted URLs.
• Disabled SSL verification: External requests (e.g., to Google reCAPTCHA) are exposed to MITM attacks.
• SQL injection: Attackers can extract data from any database table using time-based blind SQL injection techniques.
• Reflected XSS: Crafted URLs can execute JavaScript in admin sessions, leading to potential account hijacking.
• No CSRF protection & weak file validation: Exposes forms to forced submissions and file upload bypass.

Impact:
Severe risk to data confidentiality and store integrity. Exploits can be carried out by low-privilege internal users or via targeted admin attacks.

Recommendation:
Immediately uninstall or disable this module. Wait for an official patch or switch to a more secure alternative.

https://addons.prestashop.com/en/contact-forms-surveys/39561-contact-form-7-includes-captcha-recaptcha.html

---

Spoiler: Download full technical audit report (English)

Please find attached the detailed audit document for technical teams and security reviewers.

 

[ADILLLLLLLLLLLLLLLL]

thank you sirrrrrrrrrrrrrrrrrrrrrrrrrrrr

 

[PutinXuylo]

Thanks for Security Alert ets_contactform7 GL HF

 

[AquariusGaza]

Thanks for Security Alert ets_contactform7 GL HF

 

[josean]

Thank you very much for sharing this great module.

 

[cmrcmr]

Gracias por compartir este modulo

 

[moonia]

Thanks for Security Alert ets_contactform7 GL HF

 

[djsebyss]

Thanks for the alert! I like this module so I hope they fix everything in the next updates.

 

[slavi_946]

You arre awesome mate, very thankful!

 

[billoceceo]

@chibi Thanks for the valuable insights. That's what I like about a community. There's always more to learn.

 

[nriljkaung]

thank your report .but more form plugin have issue .

 

[moonfire]

Security Alert: PrestaShop Module "Contact Form 7" (ets_contactform7)

The "Contact Form 7" module (version 2.3.9 and even the latest official available version) available on this forum contains critical vulnerabilities that allow attackers to perform unauthorized actions, exfiltrate database data, and execute malicious code in administrators' browsers.

Key issues:

• Broken access control: Any authenticated back-office user with minimal rights can delete forms or modify configurations via crafted URLs.
• Disabled SSL verification: External requests (e.g., to Google reCAPTCHA) are exposed to MITM attacks.
• SQL injection: Attackers can extract data from any database table using time-based blind SQL injection techniques.
• Reflected XSS: Crafted URLs can execute JavaScript in admin sessions, leading to potential account hijacking.
• No CSRF protection & weak file validation: Exposes forms to forced submissions and file upload bypass.

Impact:
Severe risk to data confidentiality and store integrity. Exploits can be carried out by low-privilege internal users or via targeted admin attacks.

Recommendation:
Immediately uninstall or disable this module. Wait for an official patch or switch to a more secure alternative.

https://addons.prestashop.com/en/contact-forms-surveys/39561-contact-form-7-includes-captcha-recaptcha.html

---

Spoiler: Download full technical audit report (English)

Please find attached the detailed audit document for technical teams and security reviewers.

Did you found this information on a website reporting about PS modules vulnerabilities?
Or have an AI create this report?

 

[amitecosini]

thank your report .but more form plugin have issue .

 

[infoseek]

thanks for you alert and sharing,.

 

[DavidLA]

thank you very much for the alert bro.

 

[jotauve]

thank you sirrrrrrrrrrrrrrrrrrrrrrrrrrrr

 

[yog78]

Thank you very much for this information