The CVE202644212 exploit abuses a gap between email format validation and HTML output encoding. PrestaShop's ValidateisEmail() accepts RFC 5321 quotedstring local parts, which legally allow double quotes, spaces and other special characters. An attacker crafts an email like autofocus onfocus=alert(document.cookie) , submits it through the unauthenticated Contact Us form and the string lands unescaped inside a backoffice <input> attribute. When a support agent opens the thread, the injected handler executes in their session. This page walks through the exploit primitive, a working proof of concept and how defenders can detect attempts for authorized testing and lab use only.Before going further, read this as a case study in a vulnerability class, not a howto for attacking production stores you do own. Every command here assumes a local Docker lab or an engagement with written authorization.For the patch and remediation side of this CVE, see our CVE202644212 patch guide. For the conceptual overview, start with the main CVE202644212 breakdown.

AppSec Master

Published articles

CVE202644212 Exploit and PoC RFC 5321 QuotedString XSS