g0vguy/cve-2025-61922-pocA simple, educational proof-of-concept script demonstrating the zero-click account takeover vulnerability in the PrestaShop Checkout module (CVE-2025-61922).
A simple, educational proof-of-concept script demonstrating the zero-click account takeover vulnerability in the PrestaShop Checkout module (CVE-2025-61922).
⚠️ Legal & Ethical Notice: Use Responsibly This tool is for educational purposes and authorized security testing only. Use only against systems you own or have explicit written permission to test. Unauthorized access to computer systems is illegal.
This vulnerability, tracked as CVE-2025-61922 with a CVSS score of 9.1 (Critical), affects PrestaShop Checkout module versions below 5.0.5. It allows an unauthenticated attacker to log in as any customer account by simply knowing the victim's email address—a true "zero-click" attack.
The script sends a specially crafted POST request to the vulnerable endpoint:
/module/ps_checkout/ExpressCheckoutWhen successful, the server responds with session cookies for the victim's account, which can be used to hijack their session.
CVE-2025-61922.py - Main exploit scriptREADME.md - This documentation# Check if a target is vulnerable
python CVE-2025-61922.py check --url http://target-shop.com
# Exploit a specific email
python CVE-2025-61922.py takeover --url http://target-shop.com --email [email protected]
# Test captured cookies
python CVE-2025-61922.py test --url http://target-shop.com --cookies "PrestaShop-abc123=..."