CVE-2015-6497: Magento arbitrary PHP code execution via the productData parameter
Summary
CVE-2015-6497: Magento arbitrary PHP code execution via the productData parameter. Affects magento/core versions < 1.9.2.1. Fixed in 1.9.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is an open-source e-commerce platform that provides a flexible and scalable solution for online businesses. It is widely used for creating and managing online stores. The vulnerability in question affects Magento Community Edition (CE) before version 1.9.2.1 and Enterprise Edition (EE) before version 1.14.2.1. The specific vulnerability lies in the create function of the app/code/core/Mage/Catalog/Model/Product/Api/V2.php file. When this function is used with PHP versions prior to 5.4.24 or 5.5.8, remote authenticated users can exploit the vulnerability by executing arbitrary PHP code via the productData parameter in the index.php/api/v2_soap endpoint.
Vulnerability Detail
The vulnerability allows remote authenticated users to execute arbitrary PHP code on the affected Magento instances. By manipulating the productData parameter, an attacker can inject malicious PHP code that will be executed within the context of the Magento application. This can lead to various consequences, including unauthorized access, data theft, and further compromise of the affected system. The vulnerability is considered high severity with a CVSS score of 8.8.
How To Fix
Minimum fixed version
1.9.2.1
This is the first release that contains the fix.
composer require magento/core:1.9.2.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the patched versions of Magento and using a secure PHP version.
Conclusion
The vulnerability in Magento allows remote authenticated users to execute arbitrary PHP code, potentially leading to unauthorized access and data theft. It is crucial to upgrade to the patched versions of Magento and use a secure PHP version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for magento/core →
FAQ
Magento is an open-source e-commerce platform used for creating and managing online stores.
Magento Community Edition (CE) before version 1.9.2.1 and Enterprise Edition (EE) before version 1.14.2.1 are affected.
An attacker with remote authenticated access can exploit this vulnerability by manipulating the productData parameter in the index.php/api/v2_soap endpoint to execute arbitrary PHP code.
The vulnerability can lead to unauthorized access, data theft, and further compromise of the affected Magento instance.
The vulnerability is considered high severity with a CVSS score of 8.8.
Related vulnerabilities
Recent vulnerabilities recorded for magento/core.
