low3.8
CVE-2025-61924
PrestaShop Checkout Target PayPal merchant account hijacking from backoffice
Impact
### Impact Wrong usage of the PHP `array_search()` allows bypass of validation. ### Patches The problem has been patched in versions: - v4.4.1 for PrestaShop 1.7 (build number: 7.4.4.1) - v4.4.1 for PrestaShop 8 (build number: 8.4.4.1) - v5.0.5 for PrestaShop 1.7 (build number: 7.5.0.5) - v5.0.5 for PrestaShop 8 (build number: 8.5.0.5) - v5.0.5 for PrestaShop 9 (build number: 9.5.0.5) Read the [Versioning policy](https://github.com/PrestaShopCorp/ps_checkout/wiki/Versioning) to learn more about the build number. ### Credits [Léo CUNÉAZ](https://github.com/inem0o) reported this issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | prestashop/ps_checkout | < 4.4.1 | 4.4.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Prestashop | Prestashop Checkout | before 7.4.4.1 from 7.5.0.1 before 7.5.0.5 from 8.3.1.0 before 8.4.4.1 from 8.5.0.0 before 8.5.0.5 from 9.4.3.1 before 9.5.0.5 |