Prestashop 1.7 vs Thirtybees: Vulnerability, Data Security, Efficiency and Cost

Prestashop 1.7 vs Thirtybees has been a point of contention among ecommerce developers since the first of version of the Prestashop fork was released. Thirtybees is a fork of Prestashop 1.6. It was the result of the in-action of the Prestashop developers’ over the code issues and bugs fixes that was never fixed then totally abandoned by 2019.

Prestashop 1.7 is differently coded. The former core prestashop team were disbanded and obviously, replaced with younger and new ones. They went in a different direction, and came up with Symphony based version of prestashop.

Here are 5 talking point to Prestashop 1.7 vs thirtybees

The first talking point with Prestashop 1.7 vs Thirtybees is Security and vulnerability.

It is worth mentioning that Prestashop has recently discovered vulnerabilities to their core modules and some of the third party modules that came along with the core files.

They say that sometimes on Thursday,

January 2, 2020, a customer reported to prestashop team that its shop has been compromised by a malware named XsamXadoo Bot. The bot, according to the report, was able to upload some malware files into the shop which allowed him to access and control several shop settings.

Source

XsamXadoo Bot uses the CVE-2017-9841 code injection vulnerability in PHPUnit.

Read the full article about prestashop module vulnerability here.

Why is Thirtybees system NOT included in the recent CVE-2017-9841 code injection vulnerability in PHPUnit? 

The answer is simple. Since its first release, Thirtybees stripped the modules that were source of vulnerabilities. They have not been a part of the core files that shipped with the thirtybees install, namely:

• autoupdater (confirmed)
• gamification (perhaps)
• pscartabandonmentpro (third party)
• ps_facetedsearch (third party)

The modules above were the source of the security compromise according to Prestashop team.

Read full post prestashop 1.7 vs thirtybees