CVE-2023-27639

HIGHNuclei

tshirtecommerce custom_product_designer Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2023-27639 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.

Description

An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with the POST parameter file_name in the tshirtecommerce/ajax.php?type=svg endpoint, to allow a remote attacker to traverse directories on the system in order to open files (without restriction on the extension and path). Only files that can be parsed in XML can be opened. This is exploited in the wild in March 2023.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 1, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 9, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

custom_product_designer

Browse tshirtecommerce / custom_product_designer
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryHIGHPrestaShop TshirteCommerce - Directory TraversalCVSS 7.5

The Custom Product Designer (tshirtecommerce) module for PrestaShop allows HTTP requests to be forged using POST and GET parameters, enabling a remote attacker to perform directory traversal on the system and view the contents of code files.

Impact

Unauthenticated attackers can exploit directory traversal in the Custom Product Designer module to read arbitrary files including source code and configuration files, potentially accessing database credentials and sensitive PrestaShop configuration.

Remediation

Update the Custom Product Designer (tshirtecommerce) module for PrestaShop to a patched version that validates file paths and prevents directory traversal in ajax.php.

WeaknessesCWE-22
AuthorsMaStErChO
Template tagscvecve2023prestashoptshirtecommercelfivkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:tshirtecommerce:custom_product_designer:*:*:*:*:*:prestashop:*:*
Google: inurl:"/tshirtecommerce/"
https://www.cvedetails.com/cve/CVE-2023-27639/ https://security.friendsofpresta.org/module/2023/03/30/tshirtecommerce_cwe-22.html https://nvd.nist.gov/vuln/detail/CVE-2023-27639

Source: ProjectDiscovery

References

2