PrestaShop has an authenticated PHP code injection vulnerability in its back-office Performance debug-mode configuration. A user with permission to modify debug settings can inject PHP code via crafted debug cookie parameters, which are written without proper escaping into a PHP configuration file. This injected code executes with web-server privileges when the configuration file is loaded.