The PrestaShop ps_facetedsearch module suffers from a PHP Object Injection vulnerability due to unsafe unserialization of user-controlled slider filter values taken from the URL and stored in a cache. The native PHP unserialize() function is used without validation, allowing attackers to inject a malicious serialized object. This object triggers a gadget chain that writes an arbitrary PHP file into the module directory, which can be used as a webshell to execute commands remotely. The vulnerability affects all versions from 3.0.0 up to but not including 4.0.4. Exploitation is unauthenticated and remote, requiring only a crafted request to the front office. The vendor recommends upgrading the module to a patched version or applying a manual code fix replacing native unserialize() with a safer alternative. Additional mitigations include removing slider filters from templates, clearing the cache, auditing for unexpected PHP files, and blocking suspicious serialized payloads at the WAF.

Successful exploitation results in unauthenticated remote code execution on the affected PrestaShop server, allowing full compromise of the shop and underlying system. Attackers can write arbitrary PHP files and execute commands, leading to complete loss of confidentiality, integrity, and availability of the affected system.

A patch is available by upgrading the ps_facetedsearch module to version 4.0.4 or later, which removes the vulnerability. Alternatively, apply the manual fix by replacing the native unserialize() call in src/Filters/Block.php's getFromCache() method with \Tools::unSerialize(). Until patched, remove price and weight slider filters from front-office filter templates, clear the faceted-search filter cache, audit the module directory for unexpected PHP files, and monitor/block serialized PHP payloads at the WAF level. These steps reduce exposure but upgrading is the recommended remediation.