Lucene search

[email protected]CVE-2023-27637

HistoryMar 22, 2023 - 1:15 p.m.

CVE-2023-27637

2023-03-2213:15:10

CWE-89

[email protected]

web.nvd.nist.gov

nvd

cve-2023-27637

tshirtecommerce

custom product designer

prestashop

http request

sql injection

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.3%

JSON

An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised product_id GET parameter in order to exploit an insecure parameter in the front controller file designer.php, which could lead to a SQL injection. This is exploited in the wild in March 2023.

Affected configurations

NVD

Node

tshirtecommercecustom_product_designerMatch2.1.4prestashop

CPENameOperatorVersion
tshirtecommerce:custom_product_designertshirtecommerce custom product designereq2.1.4

CPE	Name	Operator	Version
tshirtecommerce:custom_product_designer	tshirtecommerce custom product designer	eq	2.1.4

References

codecanyon.net/item/prestashop-custom-product-designer/19202018

friends-of-presta.github.io/security-advisories/module/2023/03/21/tshirtecommerce_cwe-89.html

tshirtecommerce.com/

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.3%

JSON

Related for CVE-2023-27637

prion1 nvd1 cvelist1