CVE-2023-27637
📋 TL;DR
This CVE describes a SQL injection vulnerability in the tshirtecommerce (Custom Product Designer) component for PrestaShop. Attackers can forge HTTP requests with a compromised product_id parameter to execute arbitrary SQL commands. All PrestaShop installations using the vulnerable tshirtecommerce component version are affected.
💻 Affected Systems
- PrestaShop tshirtecommerce (Custom Product Designer) component
📦 What is this software?
Custom Product Designer by Tshirtecommerce
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, modification, or deletion of e-commerce data including customer information, orders, and products.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection.
🎯 Exploit Status
Actively exploited in the wild since March 2023 with simple HTTP request manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.5 or later
Vendor Advisory: https://friends-of-presta.github.io/security-advisories/module/2023/03/21/tshirtecommerce_cwe-89.html
Restart Required: No
Instructions:
1. Update tshirtecommerce component to version 2.1.5 or later. 2. Download from official vendor. 3. Replace vulnerable files. 4. Clear PrestaShop cache.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation for product_id parameter in designer.php
Modify designer.php to validate product_id as integer: if(!is_numeric($_GET['product_id'])) { die('Invalid input'); }
WAF Rule
allImplement web application firewall rules to block SQL injection patterns
Add WAF rule: Detect and block requests with SQL keywords in product_id parameter
🧯 If You Can't Patch
- Disable or remove the tshirtecommerce component entirely
- Implement network segmentation to restrict access to affected systems
🔍 How to Verify
Check if Vulnerable:
Check PrestaShop modules directory for tshirtecommerce component version 2.1.4 or earlierCheck Version:
Check module version in PrestaShop admin panel or examine module filesVerify Fix Applied:
Verify tshirtecommerce component version is 2.1.5 or later and test SQL injection attempts are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- HTTP requests with SQL keywords in product_id parameter
- Multiple failed login attempts from single IP
Network Indicators:
- HTTP GET requests to designer.php with suspicious product_id values
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND uri="*designer.php*" AND (query="*product_id=*UNION*" OR query="*product_id=*SELECT*" OR query="*product_id=*INSERT*")🔗 References
- https://codecanyon.net/item/prestashop-custom-product-designer/19202018
- https://friends-of-presta.github.io/security-advisories/module/2023/03/21/tshirtecommerce_cwe-89.html
- https://tshirtecommerce.com/
- https://codecanyon.net/item/prestashop-custom-product-designer/19202018
- https://friends-of-presta.github.io/security-advisories/module/2023/03/21/tshirtecommerce_cwe-89.html
- https://tshirtecommerce.com/
