Lucene search

MitreCVE-2023-27638

HistoryMar 22, 2023 - 1:15 p.m.

CVE-2023-27638

2023-03-2213:15:10

CWE-89

mitre

web.nvd.nist.gov

cve-2023-27638

tshirtecommerce

custom product designer

prestashop

sql injection

http requestforgery

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.001

Percentile

49.8%

JSON

An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised tshirtecommerce_design_cart_id GET parameter in order to exploit an insecure parameter in the functions hookActionCartSave and updateCustomizationTable, which could lead to a SQL injection. This is exploited in the wild in March 2023.

Affected configurations

Nvd

Node

tshirtecommercecustom_product_designerMatch2.1.4prestashop

VendorProductVersionCPE
tshirtecommercecustom_product_designer2.1.4cpe:2.3:a:tshirtecommerce:custom_product_designer:2.1.4:*:*:*:*:prestashop:*:*

Vendor	Product	Version	CPE
tshirtecommerce	custom_product_designer	2.1.4	cpe:2.3:a:tshirtecommerce:custom_product_designer:2.1.4:::::prestashop::

References

codecanyon.net/item/prestashop-custom-product-designer/19202018

friends-of-presta.github.io/security-advisories/module/2023/03/21/tshirtecommerce_cwe-89.html

tshirtecommerce.com/

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.001

Percentile

49.8%

JSON

Related for CVE-2023-27638