Is this exploit sorted in tb?

[MockoB]

https://www.ambionics.io/blog/prestashop-privilege-escalation?utmsource=newsletter&utmmedium=email&utmcampaign=prestashop1741isnowavailable16bugfixesandmoredetails&utmterm=2018-07-18

[Traumflug]

Not yet. Also not a big threat, because this exploit works only if a customer with a cart and an employee use the same password. To be safe, make sure this isn't the case.

This exploit somehow (it's complicated!) manages to extract a password hash from a customer cookie, then uses this hash to assemble an employee cookie, which allows back office access. If there are no identical passwords, it doesn't work.

Still I plan to apply the fix, of course. Part of the fix is to remove Blowfish encryption (in favor of a safer encryption).

[MockoB]

Thanks for the clarification @Traumflug Btw thanks for supporting the project!

[Traumflug]

https://github.com/thirtybees/thirtybees/issues/554