Executive brief
The UPS Shipping module for PrestaShop contains a security flaw that exposes sensitive business and customer data. This module, used to manage shipping and tracking, stores transaction logs in a publicly accessible folder without proper protection. An attacker can access these logs to steal UPS API credentials, merchant tax IDs, and customer personal information like names and addresses, potentially leading to fraudulent shipping charges or data privacy breaches.
Technical details
The upsshipping module for PrestaShop fails to implement access controls on its /logs/ directory, which is used to store XML transaction logs. These logs are generated using predictable filenames based on Unix timestamps (e.g., UPSRatingApi-request-{timestamp}.xml) and contain full SOAP requests and responses. Because the directory lacks an index.php file, .htaccess restrictions, or server-side hardening, an unauthenticated remote attacker can enumerate and download these files. The logs contain sensitive data including UPS API usernames, passwords, Access License Numbers, merchant tax IDs, and customer PII. Additionally, the module performs unconditional logging in exception handlers regardless of debug settings and suffers from a secondary issue where TLS certificate validation is disabled in lib/UPSLocatorApi.php. No patch is available as the vendor is defunct.
Affected products
- Agence Web 360 (PrestaShop) upsshipping module All versions through 2.4.0
Timeline
- 2026-05-18: advisory: Public advisory and CVE published