CVE-2023-25170: 
PHP vulnerability analysis and mitigation

PrestaShop, an open source e-commerce web application, prior to version 8.0.1, was discovered to be vulnerable to cross-site request forgery (CSRF). When authenticating users, PrestaShop preserves session attributes, which does not clear CSRF tokens upon login. This vulnerability could enable same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation (NVD, GitHub Advisory).

The vulnerability stems from PrestaShop's session management implementation where session attributes are preserved during user authentication. The critical issue is that CSRF tokens are not cleared when a user logs in, creating a security weakness. This vulnerability has been assigned a CVSS v3.1 base score of 8.8 HIGH by NVD and 5.0 MEDIUM by GitHub, with a vector string of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L. The attack requires network access and user interaction, but no privileges (NVD).

The vulnerability could allow same-site attackers to bypass the CSRF protection mechanism. This could potentially lead to unauthorized actions being performed on behalf of authenticated users, compromising the integrity of user sessions and the security of the e-commerce platform (GitHub Advisory).

The vulnerability has been patched in PrestaShop version 8.0.1. Users are advised to upgrade to this version or later to address the security issue (GitHub Advisory).