CVE-2023-27637

An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised product_id GET parameter in order to exploit an insecure parameter in the front controller file designer.php, which could lead to a SQL injection. This is exploited in the wild in March 2023.

• CWE-89
• CWE-89

• https://codecanyon.net/item/prestashop-custom-product-designer/19202018Product
• https://friends-of-presta.github.io/security-advisories/module/2023/03/21/tshirtecommerce_cwe-89.htmlExploit, Patch, Third Party Advisory
• https://tshirtecommerce.com/Product
• https://codecanyon.net/item/prestashop-custom-product-designer/19202018Product
• https://friends-of-presta.github.io/security-advisories/module/2023/03/21/tshirtecommerce_cwe-89.htmlExploit, Patch, Third Party Advisory
• https://tshirtecommerce.com/Product

Published

Mar 22, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-27631Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulne…5.4
• CVE-2023-27632Cross-Site Request Forgery (CSRF) vulnerability in mmrs151 D…8.8
• CVE-2023-27633Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrad…8.8
• CVE-2023-27634Cross-Site Request Forgery (CSRF) vulnerability allows arbit…8.8
• CVE-2023-27635debmany in debian-goodies 0.88.1 allows attackers to execute…7.8
• CVE-2023-27636Progress Sitefinity before 15.0.0 allows XSS by authenticate…5.4
• CVE-2023-27638An issue was discovered in the tshirtecommerce (aka Custom P…9.8
• CVE-2023-27639An issue was discovered in the tshirtecommerce (aka Custom P…7.5
• CVE-2023-2764The Draw Attention plugin for WordPress is vulnerable to una…4.3
• CVE-2023-27640An issue was discovered in the tshirtecommerce (aka Custom P…7.5
• CVE-2023-27641The REPORT (after z but before a) parameter in wa.exe in L-S…6.1
• CVE-2023-27643An issue found in POWERAMP 925-bundle-play and Poweramp 954-…7.5