SQL Injection in tshirtecommerce / Custom Product Designer 2.1.4 for PrestaShop

Successful exploitation can allow an attacker to manipulate backend SQL queries. Depending on the application’s query structure and database privileges, this may enable unauthorized reading of database contents, modification or deletion of data, authentication bypass in some scenarios, and potentially broader compromise of the affected PrestaShop instance. At minimum, the vulnerability exposes the application to database-layer compromise through unauthenticated web requests if the vulnerable endpoint is reachable.

If an immediate patch is not available, restrict access to the vulnerable designer.php endpoint where feasible, including via WAF rules that block SQL injection patterns and unexpected product_id input. Enforce allowlisting for numeric product identifiers at the application or reverse-proxy layer. Minimize database account privileges used by the application to reduce post-exploitation impact. Increase monitoring for suspicious requests targeting the product_id parameter and for anomalous database activity. If compromise is suspected, rotate credentials and investigate the host and application for follow-on persistence or tampering.

Upgrade or replace the vulnerable tshirtecommerce / Custom Product Designer component version 2.1.4 with a fixed version from the vendor if available. Review and patch designer.php so that the product_id parameter is strictly validated, type-enforced, and incorporated into database operations only through parameterized queries or safe ORM methods. Conduct a code review for similar unsafe handling of request parameters elsewhere in the component. Because exploitation in the wild has been reported, review web server, application, and database logs for indicators of SQL injection attempts and assess the integrity of the PrestaShop environment.