CVE-2023-27637

CRITICALNuclei

tshirtecommerce custom_product_designer Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2023-27637 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised product_id GET parameter in order to exploit an insecure parameter in the front controller file designer.php, which could lead to a SQL injection. This is exploited in the wild in March 2023.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Mar 21, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 26, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

custom_product_designer

Browse tshirtecommerce / custom_product_designer
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALPrestaShop `tshirtecommerce` Module - SQL InjectionCVSS 9.8

The tshirtecommerce module for PrestaShop is vulnerable to unauthenticated SQL injection via the designer endpoint, allowing attackers to execute arbitrary SQL queries and extract sensitive information from the database.

Impact

Unauthenticated attackers can execute time-based SQL injection through the parent_id parameter in the designer endpoint to extract the complete PrestaShop database including user credentials and order data.

Remediation

Update the tshirtecommerce module to the latest version and apply all security patches.

WeaknessesCWE-89
Authorsritikchaddha
Template tagscvecve2023prestashoptshirtecommercesqlitime-based-sqlivkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:tshirtecommerce:custom_product_designer:2.1.4:*:*:*:*:prestashop:*:*
FOFA: body="Prestashop" && body="tshirtecommerce"
https://security.friendsofpresta.org/module/2023/03/21/tshirtecommerce_cwe-89.html https://nvd.nist.gov/vuln/detail/CVE-2023-27637 https://codecanyon.net/item/prestashop-custom-product-designer/19202018 https://tshirtecommerce.com/

Source: ProjectDiscovery

References

4