CVE-2023-39530: 
PHP vulnerability analysis and mitigation

PrestaShop, an open-source e-commerce web application, was found to contain a vulnerability (CVE-2023-39530) that allows unauthorized file deletion from the server via the CustomerMessage API. This vulnerability affects versions prior to 8.1.1 and was discovered by security researcher Kto94 through the Yeswehack platform. The issue was publicly disclosed on August 7, 2023 (GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 9.1 (CRITICAL) by NVD, with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. The vulnerability allows attackers to delete files from the server through the CustomerMessage API. The attack vector is network-accessible, requires low attack complexity, and needs no user interaction to exploit (NVD).

The vulnerability's primary impact is on system integrity and availability, with high potential for both. An attacker could exploit this vulnerability to delete files from the server, potentially causing significant disruption to the e-commerce platform's operations. The confidentiality impact is rated as none, indicating that the vulnerability does not expose sensitive information (GitHub Advisory).

The vulnerability is remotely exploitable over the network and requires low attack complexity to execute. No user interaction is needed for exploitation, making it particularly dangerous. The attack can be performed through the CustomerMessage API (Security Online).

The vulnerability has been patched in PrestaShop version 8.1.1. There are no known workarounds for this security issue, making it critical for affected users to upgrade to the patched version. The fix involves modifying the file deletion mechanism in the CustomerMessage class (GitHub Patch).