# CVE-2023-27638: Tshirtecommerce - SQLi

> Live exploitation tracking for CVE-2023-27638 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2023-27638

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Tshirtecommerce
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
- **Tags:** ecommerce, php

## Description

An issue was discovered in the Tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised tshirtecommerce_design_cart_id GET parameter in order to exploit an insecure parameter in the functions hookActionCartSave and updateCustomizationTable, which could lead to a SQL injection. This is exploited in the wild in March 2023.

## CrowdSec analysis

[CVE-2023-27638](https://euvd.enisa.europa.eu/vulnerability/CVE-2023-27638) is a critical SQL injection vulnerability in the tshirtecommerce (Custom Product Designer) component for PrestaShop, version 2.1.4. By manipulating the tshirtecommerce_design_cart_id GET parameter, remote attackers can exploit insecure parameters in key functions to execute arbitrary SQL commands. This flaw can lead to unauthorized data access, data manipulation, or even full compromise of the affected database, and has been actively exploited in the wild as of March 2023.

CrowdSec has been tracking this vulnerability and its exploits since 11th of February 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2023-27638 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the `/module/tshirtecommerce/designer` endpoint by injecting SQL commands into the `tshirtecommerce_design_cart_id` parameter, often using payloads like `1 OR SLEEP(8)` to test for and exploit SQL injection vulnerabilities.

## Timeline

- 2023-03-22: CVE Published. CVE-2023-27638 is published to NVD.
- 2026-02-11: Rule Released. CrowdSec releases a rule to detect CVE-2023-27638 exploitation attempts against the CrowdSec Network.
- 2026-07-06: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2023-27638 for the first time.

## References

- https://friends-of-presta.github.io/security-advisories/module/2023/03/21/tshirtecommerce_cwe-89.html
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27638.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2023-27638) follows observed exploitation activity for CVE-2023-27638. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.