Description
在 PrestaShop 的 tshirtecommerce（又名 Custom Product Designer）组件 2.1.4 中发现了一个问题。通过/tshirtecommerce/fonts.php 端点的 POST 参数 type，可以伪造 HTTP 请求，允许远程攻击者遍历系统目录以打开文件（对扩展名和路径无限制）。文件内容以 base64 编码返回。
PrestaShop tshirtecommerce /tshirtecommerce/fonts.php 目录遍历漏洞（CVE-2023-27640）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://security.friendsofpresta.org/module/2023/03/30/tshirtecommerce_cwe-22.html
https://nvd.nist.gov/vuln/detail/CVE-2023-27640
https://www.cve.org/CVERecord?id=CVE-2023-27640
https://vulners.com/cve/CVE-2023-27640
https://s4e.io/tools/the-custom-product-designer-tshirtecommerce-module-for-prestashop-directory-traversal-cve-2023-27640
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27640.yaml
https://pentest-tools.com/vulnerabilities-exploits/prestashop-tshirtecommerce-directory-traversal_22463
https://www.incibe.es/en/incibe-cert/early-warning/vulnerabilities/cve-2023-27640
https://cve.imfht.com/detail/CVE-2023-27640