CVE-2018-8823: PrestaShop Responsive Mega Menu Pro module unauthenticated PHP code injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS of 9.8, public exploit references and very high EPSS probability makes this an urgent patch-or-remove item.

What it is

The Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for PrestaShop passes the 'code' parameter from modules/bamegamenu/ajax_phpcode.php into PHP code execution without sanitization. This is a code injection (CWE-94) flaw that lets an unauthenticated remote attacker run arbitrary PHP on the server. Because the module is a front-end component, the endpoint is reachable without credentials.

Impact

An attacker can execute arbitrary PHP code in the web server context, leading to full compromise of the PrestaShop site, including data theft, webshell deployment and lateral movement. CVSS 3.0 rates it 9.8 critical with high confidentiality, integrity and availability impact.

Attack surface

Reached over the network via the module's ajax_phpcode.php endpoint with a crafted 'code' parameter. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.50398 (98.857th percentile) and both references are tagged Exploit, indicating public exploit code exists and exploitation is likely.

What to do

• Update the Responsive Mega Menu Pro module to a version later than 1.0.32, or remove/disable the module if no fixed release is available.
• Apply a WAF rule blocking requests to modules/bamegamenu/ajax_phpcode.php that contain PHP code in the 'code' parameter.
• Restrict or block direct access to ajax_phpcode.php at the web server until the module is patched.
• Audit the PrestaShop installation for webshells and unexpected PHP files after any suspected exposure.
• Run the PrestaShop site with least-privilege file permissions and disable PHP execution in upload/media directories.

Detection

• Monitor web logs for POST or GET requests to modules/bamegamenu/ajax_phpcode.php, especially with a 'code' parameter containing PHP tags or function calls.
• Alert on outbound connections or child processes spawned by the web server user (www-data) that are unusual for PrestaShop.
• Scan the PrestaShop filesystem for newly created or modified PHP files, particularly in modules, upload and cache directories.
• Use file integrity monitoring on the PrestaShop codebase to detect injected code.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.