Tshirtecommerce - SQLi (CVE-2023-27638)
Description
An issue was discovered in the Tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised tshirtecommerce_design_cart_id GET parameter in order to exploit an insecure parameter in the functions hookActionCartSave and updateCustomizationTable, which could lead to a SQL injection. This is exploited in the wild in March 2023.
psychologyCrowdSec Analysis
CVE-2023-27638 is a critical SQL injection vulnerability in the tshirtecommerce (Custom Product Designer) component for PrestaShop, version 2.1.4. By manipulating the tshirtecommerce_design_cart_id GET parameter, remote attackers can exploit insecure parameters in key functions to execute arbitrary SQL commands. This flaw can lead to unauthorized data access, data manipulation, or even full compromise of the affected database, and has been actively exploited in the wild as of March 2023.
CrowdSec has been tracking this vulnerability and its exploits since 11th of February 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2023-27638 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit the /module/tshirtecommerce/designer endpoint by injecting SQL commands into the tshirtecommerce_design_cart_id parameter, often using payloads like 1 OR SLEEP(8) to test for and exploit SQL injection vulnerabilities.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2023-03-22 |
| Rule Released | 2026-02-11 |
| CrowdSec First Seen | 2026-07-06 |