The ps_facetedsearch module in PrestaShop versions >=3.0.0 <4.0.4 suffers from a PHP Object Injection vulnerability due to unsafe unserialize() usage on user-controlled slider filter values stored in a cache. By sending a specially crafted request with malicious serialized PHP objects in the price or weight slider filter parameters, an unauthenticated attacker can trigger deserialization that writes an arbitrary PHP file (webshell) to the module directory. This leads to remote code execution and full system compromise. The vulnerability affects all shops using the vulnerable module versions with slider filters enabled in the front office.

Successful exploitation results in unauthenticated remote code execution on the server hosting the PrestaShop instance. This allows an attacker to fully compromise the affected shop and its underlying server, including arbitrary command execution and potential data theft or service disruption.

A patch is available by upgrading the ps_facetedsearch module to version 4.0.4 or later, which replaces the unsafe native unserialize() call with a safer alternative. Until the module is upgraded, remove price and weight slider filters from front-office filter templates, clear the faceted-search filter cache, and audit the module directory for unexpected PHP files. Additionally, monitor and block search requests containing PHP serialization patterns at the WAF level. Applying the official module upgrade is the recommended and most effective remediation.