A SQL Injection vulnerability in the Advanced Popup Creator (advancedpopupcreator) module for PrestaShop, before version 1.2.7, allows remote unauthenticated attackers to execute arbitrary SQL queries via the fromController parameter in the popup controller.

Summary

  • CVE ID: CVE-2025-69633
  • Published at: 2026-02-13
  • Advisory source: labs.esokia.com (esokia.com)
  • Platform: PrestaShop
  • Product: advancedpopupcreator
  • Impacted release: < 1.2.7 (1.2.7 fixed issue)
  • Product author: Idnovate
  • Weakness: CWE-89
  • Severity: critical (9.8)

Description

Up to version 1.2.6, SQL queries in the FrontController endpoint popup.php of the Advanced Popup Creator (advancedpopupcreator) module can be exploited through trivial HTTP requests to perform SQL injection via the fromController parameter submitted through POST or GET.

This vulnerability was observed during incident response investigations and may have been actively exploited in the wild.

The vendor confirmed that the vulnerability has been present since at least version 1.1.26. The exact version in which it was introduced has not been determined. Therefore, we consider that all versions prior to 1.2.7 are vulnerable.

This vulnerability relies on PrestaShop’s FrontController, which allows attackers to hide the module controller’s path during the exploit. As a result, conventional frontend logs won’t reveal that this vulnerability is being exploited. Only POST / will be visible in logs. Activating the AuditEngine of mod_security (or similar) is the only way to get data to confirm this exploit.

CVSS base metrics

  • Attack vector: network
  • Attack complexity: low
  • Privilege required: none
  • User interaction: none
  • Scope: unchanged
  • Confidentiality: high
  • Integrity: high
  • Availability: high

Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Possible malicious usage

  • Retrieve administrator credentials and ultimately obtain admin access to BackOffice
  • Discover back-office URL
  • Extract sensitive database information

Patch

The issue was fixed by sanitizing $controller using pSQL():

- OR FIND_IN_SET("' . $controller . '", `controller_exceptions`))';
+ OR FIND_IN_SET("' . pSQL($controller) . '", `controller_exceptions`))';

Applied at two different places in the code:

  • Line ~371
  • Line ~986

Fixed version: 1.2.7

Other recommendations

  • It’s highly recommended to upgrade the module to the latest version or to delete the module if unused.
  • Enforce strong Back Office authentication controls. Enable Two-Factor Authentication (2FA), preferably TOTP-based for all accounts in BackOffice. Make sure that the module is not storing TOTP secret keys in plaintext within the database.
  • Restrict and rotate the Back Office URL. Do not expose the administration URL publicly. If it has been disclosed or indexed, rename and restrict it immediately.
  • To help improve the security of your PrestaShop installation, we recommend upgrading to the latest version. One of the benefits of upgrading is that it will disable the use of multiquery executions (separated by semicolons). However, please be aware that this will not protect your shop against SQL injection attacks that use the UNION clause to steal data. Additionally, it’s important to note that PrestaShop includes a function called pSQL, which includes a strip_tags function. This helps protect your shop against Stored XSS (also known as XSS T2) of Category 1. If a pSQL function is missing, it could potentially expose your project to critical Stored XSS vulnerabilities due to edge cases. Therefore, it’s crucial to ensure that all relevant functions are properly implemented and used consistently throughout your project.
  • Change the default database prefix ps_ with a new longer, arbitrary prefix. Nevertheless, be warned that this is useless against blackhats with DBA senior skills because of a design vulnerability in DBMS
  • Activate OWASP 942’s rules on your WAF (Web application firewall), be warned that you will probably break your backoffice and you will need to pre-configure some bypasses against this set of rules.

Timeline

Date Action
2025-12-10 Vulnerability reported responsibly to Idnovate and PrestaShop security
2025-12-10 Vendor confirms fix released
2025-12-18 Affected versions confirmed ( < 1.2.7, fixed in 1.2.7)
2025-12-18 CVE requested from MITRE
2026-01-28 MITRE assigned CVE-2025-69633
2026-02-02 Final technical verification prior to publication
2026-02-13 Publication of the CVE by Esokia with the support of Profileo.com / 772424.com
2026-02-16 Publication on Friends-Of-Prestashop Security Advisories