ID:2613 - Exploit for Information disclosure in PrestaShop - CVE-2020-5250

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists when a customer edits their address, they can freely change the id_address in the form. A remote authenticated attacker can steal someone else's address.

It is the same with CustomerForm, you are able to change the id_customer and change all information of all accounts.

Remediation