CVE-2023-27640

The PrestaShop module tshirtecommerce (Custom Product Designer) version 2.1.4 is affected by a directory traversal vulnerability in the fonts.php endpoint. An attacker can forge HTTP requests using the POST parameter type (and related GET parameters) to traverse the server’s file system and read ...

CVE-2023-27638

CVE-2023-27638 concerns the PrestaShop module tshirtecommerce (Custom Product Designer) v2.1.4. The issue arises from an unauthenticated SQL injection via the parameter tshirtecommerce_design_cart_id , caused by an insecure handling of this input in the functions hookActionCartSave and updateCust...

CVE-2023-27637

Summary of CVE-2023-27637 (PrestaShop tshirtecommerce module) The PrestaShop module tshirtecommerce (Custom Product Designer) version 2.1.4 is reported vulnerable to unauthenticated SQL injection via the designer endpoint. The flaw is triggered by forging an HTTP request with a compromised produc...

CVE-2023-27639

Summary of CVE-2023-27639 (PrestaShop Tshirtecommerce) The Custom Product Designer (tshirtecommerce) module for PrestaShop, version 2.1.4 and earlier, allows an HTTP request to be forged via the POST parameter file_name in the endpoint tshirtecommerce/ajax.php?type=svg. This enables a remote atta...