CVE-2023-27638

CRITICALNuclei

tshirtecommerce custom_product_designer Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2023-27638 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised tshirtecommerce_design_cart_id GET parameter in order to exploit an insecure parameter in the functions hookActionCartSave and updateCustomizationTable, which could lead to a SQL injection. This is exploited in the wild in March 2023.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Mar 21, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 26, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

custom_product_designer

Browse tshirtecommerce / custom_product_designer
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryHIGHtshirtecommerce PrestaShop Module - SQL InjectionCVSS 9.8

The tshirtecommerce module for PrestaShop is vulnerable to unauthenticated SQL injection via the tshirtecommerce_design_cart_id parameter, allowing attackers to execute arbitrary SQL queries and extract sensitive information from the database. This is due to lack of input sanitization, as shown in the patch where pSQL() is now used.

Impact

Unauthenticated attackers can execute SQL injection through the tshirtecommerce_design_cart_id parameter to extract the complete PrestaShop database including customer data and payment information.

Remediation

Update the tshirtecommerce module to the latest version and apply all security patches.

WeaknessesCWE-89
Authorsritikchaddha
Template tagscvecve2023prestashoptshirtecommercesqlivkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
FOFA: body="Prestashop" && body="tshirtecommerce"
https://security.friendsofpresta.org/module/2023/03/21/tshirtecommerce_cwe-89.html https://nvd.nist.gov/vuln/detail/CVE-2023-27638

Source: ProjectDiscovery

References

4