CVE-2025-61924: 
PHP vulnerability analysis and mitigation

CVE-2025-61924 is a PayPal merchant account hijacking vulnerability in the PrestaShop Checkout module (ps_checkout), the official PrestaShop payment module developed in partnership with PayPal. The flaw stems from incorrect use of PHP's array_search() function in the backoffice, allowing a high-privileged attacker to bypass validation and redirect payment processing to an attacker-controlled PayPal merchant account. Affected versions include all releases prior to 4.4.1 (for PrestaShop 1.7 and 8) and prior to 5.0.5 (for PrestaShop 1.7, 8, and 9). It was disclosed on October 16, 2025, and carries a CVSS v3.1 base score of 3.8 (Low) (Github Advisory, PrestaShop Advisory).

The root cause is classified as CWE-184 (Incomplete List of Disallowed Inputs), arising from the misuse of PHP's array_search() function in the module's backoffice validation logic. PHP's array_search() uses loose type comparison by default, meaning it can return 0 (the index of the first element) when searching for certain falsy values, which evaluates as truthy and bypasses the intended input blocklist check. An attacker with high privileges (e.g., a backoffice administrator) can exploit this to substitute a legitimate PayPal merchant account identifier with their own, effectively hijacking payment flows. The vulnerability was reported by security researcher Léo CUNÉAZ (alias iNem0o) (PrestaShop Advisory, Github Advisory).

Successful exploitation allows an attacker with backoffice access to redirect customer payments to an attacker-controlled PayPal merchant account, resulting in financial fraud and loss of revenue for the legitimate store owner. The confidentiality and integrity impacts are both rated Low — the attacker may gain limited access to payment configuration data and can modify the target merchant account setting. Availability is not impacted. The scope is limited to the affected component, but the financial consequences for affected merchants can be significant despite the low CVSS score (Github Advisory, PrestaShop Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-61924. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.041% (13th percentile), indicating a low probability of exploitation in the near term. Exploitation requires high privileges (backoffice administrator access), which significantly limits the attack surface (Github Advisory).

1. Gain Backoffice Access: Obtain administrator-level credentials to the PrestaShop backoffice, either through credential theft, phishing, or insider access.
2. Navigate to Payment Configuration: Access the PrestaShop Checkout (ps_checkout) module settings within the backoffice administration panel.
3. Manipulate Merchant Account Input: Submit a crafted input value for the PayPal merchant account field that exploits the loose comparison behavior of PHP's array_search() — for example, a value that evaluates as falsy (e.g., 0, false, or an empty string) to bypass the validation blocklist.
4. Bypass Validation: The flawed array_search() call returns index 0 for the crafted input, which passes the validation check incorrectly, allowing the attacker-supplied merchant account identifier to be saved.
5. Redirect Payments: Customer payments processed through the store are now routed to the attacker's PayPal merchant account instead of the legitimate store owner's account (PrestaShop Advisory).

• Logs: Unexpected changes to the PayPal merchant account configuration in PrestaShop backoffice audit logs or database change logs; administrator activity logs showing modification of ps_checkout module settings from an unusual IP address or at an unusual time.
• Database: The ps_configuration table entry for the PayPal merchant account ID (PS_CHECKOUT_PAYPAL_ID_MERCHANT or equivalent) changed to an unrecognized value.
• Network: Outbound payment transactions routed to an unfamiliar PayPal merchant account ID; PayPal transaction reports showing payments credited to an account not belonging to the store owner.
• Application: Discrepancies between expected and actual PayPal merchant account displayed in the ps_checkout module backoffice settings (PrestaShop Advisory).

PrestaShop has released patched versions addressing this vulnerability: v4.4.1 (build numbers 7.4.4.1 for PrestaShop 1.7, 8.4.4.1 for PrestaShop 8) and v5.0.5 (build numbers 7.5.0.5 for PrestaShop 1.7, 8.5.0.5 for PrestaShop 8, 9.5.0.5 for PrestaShop 9). No known workarounds exist; upgrading to a patched version is the only remediation. Store administrators should also audit their PayPal merchant account configuration after upgrading to verify it has not been tampered with (PrestaShop Advisory, Github Advisory).