Threat Intelligence Database

Thelia versions before 3.1.2 and 3.2.x before 3.2.1 have an unrestricted file upload vulnerability. Authenticated back-office users can upload PHP files by exploiting a filename handling flaw involving trailing spaces. This allows storing executable PHP files in the public cache directory, enabling code execution as the web server user.

Thelia versions before 3.1.2 and 3.2.x before 3.2.1 are vulnerable to a CSV formula injection. This vulnerability allows unauthenticated users to inject spreadsheet formulas via registration, checkout, or newsletter fields. The injected formulas can execute when an administrator opens the exported CSV file in a spreadsheet application.

Thelia version 2.6.1 contains chained vulnerabilities in its translation editor that allow an authenticated user with specific update permissions to perform path traversal and PHP code injection. These vulnerabilities enable writing malicious PHP files to web-accessible locations, leading to remote code execution with the web server's privileges.

Thelia version 2.6.0 contains a reflected Cross-Site Scripting (XSS) vulnerability in its Smarty templates (address.html and address-update.html). The issue arises because the "next" parameter is not properly escaped for double quotes, allowing an attacker to inject malicious JavaScript code that executes when an authenticated user visits a crafted link.

Thelia 2.6.0 uses the Smarty templating engine for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions via the messages configuration interface. When these templates are previewed or rendered, functions like system(), exec(), file_put_contents(), and file_get_contents() can be executed with the web server's privileges, enabling arbitrary OS command execution and file read/write operations on the server.

Thelia v2.6.0 has a vulnerability where the administrative login and forgotten password endpoints respond differently to invalid usernames versus incorrect passwords. This behavior allows unauthenticated attackers to enumerate valid administrator usernames. Additionally, the endpoints lack rate limiting or protections against repeated authentication attempts, enabling efficient large-scale username enumeration.

Thelia version 2.6.0 has an open redirect vulnerability in its address creation workflow. When a user submits the 'Add New Address' form via a crafted URL containing a 'next' parameter, the application redirects the user to the URL specified in that parameter without validating its destination. This allows attackers to redirect users to arbitrary external websites controlled by the attacker.

Thelia version 2.6.0 contains a vulnerability in its store banner upload feature where filetype validation relies solely on client-supplied MIME types. This insufficient validation allows an attacker with administrative privileges to upload a malicious PHP file disguised as an image, potentially leading to remote code execution on the server.

Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities affecting file management, Smarty templating, module installation, and administrative workflows. These include remote code execution, server-side template injection, stored and reflected cross-site scripting, open redirect, and username enumeration. Exploitation requires authenticated administrative access for most issues, but some vulnerabilities enable unauthenticated attackers to enumerate valid admin usernames. No patch is currently available, and risk mitigation involves restricting administrative interface access and disabling or limiting certain features.