PrestaShop security audit: attack vectors and technical analysis for online stores
By Kike Gandia · Co-Founder & CEO, OSCP
PrestaShop is the most widely used e-commerce platform in Spain among SMBs and mid-market companies. Its popularity, combined with a third-party module ecosystem of uneven quality control, makes PrestaShop installations frequent targets of automated attacks and skimming campaigns. A security audit assesses the store's real resilience against these attacks.
Common attack vectors in PrestaShop
Vulnerable modules: The most frequent entry vector. The PrestaShop module marketplace includes extensions with SQLi, XSS and unrestricted file upload vulnerabilities that have active public exploits. The lack of a systematic module review process in many stores means vulnerabilities persist for months.
Exposed admin panel: By default the panel sits at /admin (renamed during installation, but often predictable). Without additional IP or MFA protection, it is a target for brute force and credential stuffing.
SQL injection in custom modules: Modules built bespoke for specific integrations rarely undergo a security code review. Queries built dynamically without prepared statements are a common pattern.
Checkout skimming: As with Magento, Magecart-style attacks hit PrestaShop through vulnerable payment modules or third-party scripts on the checkout page.
What the PrestaShop security audit covers
- Analysis of the core version and patch level against PrestaShop's security update history
- Review of all active modules against known CVEs and code analysis of custom modules
- Testing of the admin panel: authentication, MFA, user enumeration and brute force
- Analysis of the checkout process and the installed payment modules
- SQL injection, XSS and file upload testing in forms and modules
- Review of the server configuration: file permissions, access to the /config directory and exposed configuration files
- Analysis of external integrations: ERP, CRM, marketing tools and logistics platforms
Difference between a security audit and updating modules
Updating modules resolves known vulnerabilities with a published patch. A PrestaShop security audit goes further: it assesses whether the current configuration is secure under a real attack, detects vulnerabilities in custom modules with no public CVE, identifies web shells or backdoors from earlier undetected compromises and validates that external integrations do not introduce additional vectors.
FAQ
Is the audit compatible with PrestaShop 1.7 and PrestaShop 8?
Yes. The methodology adapts to the installed version. PrestaShop 1.7 has security particularities distinct from the 8 branch, and many stores remain on 1.7 due to module incompatibilities. We assess it in its real context.
What happens if you detect an active compromise during the audit?
We report it immediately and adapt the analysis to identify the scope of the compromise: which files have been modified, what persistence exists and what data may have been affected. This typically leads to an incident response engagement.