CVE-2024-21627: 
PHP vulnerability analysis and mitigation

PrestaShop, an open-source e-commerce platform, disclosed a vulnerability (CVE-2024-21627) affecting versions prior to 8.1.3 and 1.7.8.11. The vulnerability stems from the isCleanHTML method failing to detect certain event attributes, which could potentially lead to cross-site scripting attacks (Vendor Advisory).

The vulnerability exists in the input validation mechanism where some event attributes are not properly detected by the isCleanHTML method. The issue received a CVSS v3.1 base score of 8.1 (HIGH) with a vector string of CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N, indicating a network-accessible vulnerability requiring high privileges and user interaction (NVD).

The vulnerability could allow attackers to execute cross-site scripting (XSS) attacks through modules that utilize the isCleanHTML method. This could potentially lead to unauthorized access to sensitive data and compromise of web application integrity (Vendor Advisory).

The vulnerability has been patched in PrestaShop versions 8.1.3 and 1.7.8.11. As a workaround, users are advised to utilize the HTMLPurifier library for sanitizing HTML input from users, which is already included as a dependency in the PrestaShop project. However, users should note that in legacy object models, fields of HTML type will still call isCleanHTML (Vendor Advisory).