The ps_facetedsearch module in PrestaShop versions >=3.0.0 and <4.0.4 rebuilds selected search filters from the request URL, including slider filter values for price or weight. These values are taken without sufficient validation and stored in an internal filter-block cache where they are serialized. Later, the cached data is read back using PHP's native unserialize() function in src/Filters/Block.php. An attacker can craft a malicious serialized PHP object to be injected into this cache. When deserialized, the object triggers a gadget chain that writes an arbitrary PHP file inside the modules/ps_facetedsearch/ directory. This file acts as a webshell, enabling remote command execution on the server. The vulnerability is addressed and fixed in version 4.0.4 of the module.

An unauthenticated attacker can exploit this vulnerability to achieve remote code execution on the affected server by writing a webshell file. This leads to full compromise of confidentiality, integrity, and availability of the system running the vulnerable PrestaShop module. The CVSS v3.1 base score is 10.0, indicating critical severity with network attack vector, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Upgrade the ps_facetedsearch module to version 4.0.4 or later, where this vulnerability is fixed. No other mitigations are indicated or effective since the issue involves unsafe deserialization of user-controlled input. Patch status is confirmed fixed in 4.0.4.