Hackers have been observed actively exploiting a critical zero-day vulnerability chain affecting the PrestaShop open-source e-commerce platform in order to steal transaction and payment data from online stores and marketplaces. The flaw, tracked as CVE-2022-36408, is an SQL injection vulnerability in the “blockwishlist” module. If successfully exploited, the attackers can perform remote arbitrary code execution (ACE) against servers running PrestaShop websites. The threat actors execute the attack by sending a maliciously crafted POST request to a vulnerable endpoint, immediately followed by a parameter-less GET request to the target homepage. This creates a file called “blm.php” at the root of the online shop’s directory, and a follow-on GET request to the newly created file allows for the ACE. After gaining full control of the online shop, the threat actors can inject skimmer code via a spoofed payment form engineered to steal sensitive transaction data entered by victims during checkout, funneling the data back to a command-and-control (C2) node. PrestaShop is described as the leading open-source e-commerce solution in Europe and Latin America, and their maintainer team issued a warning on July 22, 2022, urging the administrators of the 300,000 e-commerce shops deploying PrestaShop to update to the latest version of the software. Although it isn’t 100% confirmed, research findings indicate that the threat actors may be using MySQL Smarty cache storage as part of their initial attack vector. Although disabled by-default, CTIX analysts recommend that site administrators manually confirm that the MySQL Smarty cache storage feature is disabled, since it can be enabled remotely by the threat actor.