CVE-2023-27637 Scanner

PrestaShop is an open-source e-commerce platform used by thousands of online retailers worldwide to build and manage their stores. The tshirtecommerce module, a popular third-party add-on, enables merchants to offer customizable product designs, such as custom t-shirts, directly on their storefront. This module is widely adopted by businesses seeking to provide personalized shopping experiences, making it a critical component for many e-commerce operations.

CVE-2023-27637 is a critical SQL injection vulnerability discovered in the PrestaShop tshirtecommerce module. This flaw arises due to insufficient sanitization of user-supplied input before it is used in SQL queries. Attackers can exploit this by injecting malicious SQL statements through vulnerable parameters, bypassing authentication and gaining direct access to the underlying database.

Specifically, the vulnerability resides in the module's AJAX endpoint that handles product customization requests. The 'id_product' parameter is not properly validated or escaped, allowing an unauthenticated attacker to inject SQL commands. By crafting a malicious request to this endpoint, an attacker can manipulate the SQL query to extract, modify, or delete data from the PrestaShop database.

If exploited, this vulnerability can lead to complete compromise of the e-commerce site. An attacker could steal customer personally identifiable information (PII), including names, addresses, and payment details. Additionally, they could gain administrative access to the PrestaShop backend, deface the website, or inject malware, resulting in severe financial and reputational damage.