CVE-2023-27637criticalobserved exploitationCWE-89

CVE-2023-27637

Published 22 Mar 2023 · Updated 26 Feb 2025

Follow this CVE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

65Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 9.8epss 3.3%

from disclosure to weapon

Published on NVDMar 22

VulnCheckMar 21

An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised product_id GET parameter in order to exploit an insecure parameter in the front controller file designer.php, which could lead to a SQL injection. This is exploited in the wild in March 2023.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

n/a · n/a

References

https://codecanyon.net/item/prestashop-custom-product-designer/19202018 https://friends-of-presta.github.io/security-advisories/module/2023/03/21/tshirtecommerce_cwe-89.html https://tshirtecommerce.com/