CVSS: 8.8EPSS: 3%CPEs: 4EXPL: 4CVE-2015-6497 – Magento 1.9.2 File Inclusion
https://notcve.org/view.php?id=CVE-2015-6497
The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData parameter to index.php/api/v2_soap. La función create en el archivo app/code/core/Mage/Catalog/Model/Product/Api/V2.php en Magento Community Edition (CE) versiones anteriores a 1.9.2.1 y Enterprise Edition (EE) versiones anteriores a 1.14.2.1, cuando es usado con PHP versiones anteriores a 5.4.24 o 5.5.8, permite a usuarios autenticados remotos ejecutar código PHP arbitrario por medio del parámetro productData en index.php/api/v2_soap. Magento versions 1.9.2 and below suffer from an autoloaded file inclusion vulnerability. • http://blog.mindedsecurity.com/2015/09/autoloaded-file-inclusion-in-magento.html http://karmainsecurity.com/KIS-2015-04 http://magento.com/security/patches/supee-6482 http://packetstormsecurity.com/files/133544/Magento-1.9.2-File-Inclusion.html http://seclists.org/fulldisclosure/2015/Sep/48 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 86%CPEs: 2EXPL: 5CVE-2015-1397 – Magento eCommerce - Remote Code Execution
https://notcve.org/view.php?id=CVE-2015-1397
SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[field_expr] parameter when the popularity[from] or popularity[to] parameter is set. Vulnerabilidad de inyección SQL en la función getCsvFile en la clase Mage_Adminhtml_Block_Widget_Grid en Magento Community Edition (CE) 1.9.1.0 y Enterprise Edition (EE) 1.14.1.0 permite a administradores remotos ejecutar comandos SQL arbitrarios a través del parámetro popularity[field_expr] cuando el parámetro popularity[from] o popularity[to] está configurado. • https://www.exploit-db.com/exploits/37977 https://github.com/tmatejicek/CVE-2015-1397 https://github.com/WHOISshuvam/CVE-2015-1397 https://github.com/Wytchwulf/CVE-2015-1397-Magento-Shoplift http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability http://www.securitytracker.com/id/1032194 https://blog.sucuri.net/2015/04/magento-shoplift-supee-5344-exploits-in-the-wild.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 81%CPEs: 2EXPL: 1CVE-2015-1398
https://notcve.org/view.php?id=CVE-2015-1398
Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to include and execute certain PHP files via (1) .. (dot dot) sequences in the PATH_INFO to index.php or (2) vectors involving a block value in the ___directive parameter to the Cms_Wysiwyg controller in the Adminhtml module, related to the blockDirective function and the auto loading mechanism. NOTE: vector 2 might not cross privilege boundaries, since administrators might already have the privileges to execute code and upload files. Múltiples vulnerabilidades de salto de directorio en Magento Community Edition (CE) 1.9.1.0 y Enterprise Edition (EE) 1.14.1.0 permiten a usuarios remotos autenticados incluir y ejecutar ciertos ficherso PHP a través de (1) secuencias de .. (punto punto) en PATH_INFO en index.php o (2) vectores que involucran un valor de bloque en el parámetro ___directive en el controlador Cms_Wysiwyg en el módulo Adminhtml, relacionado con la función blockDirective y el mecanismo de carga automática. • http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability http://www.securitytracker.com/id/1032194 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 61%CPEs: 2EXPL: 1CVE-2015-1399
https://notcve.org/view.php?id=CVE-2015-1399
PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary PHP code via a URL in unspecified vectors involving the setScriptPath function. NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary files. Vulnerabilidad de la inclusión remota de ficheros PHP en la función fetchView en la clase Mage_Core_Block_Template_Zend en Magento Community Edition (CE) 1.9.1.0 y Enterprise Edition (EE) 1.14.1.0 permite a administradores remotos ejecutar código PHP arbitrario a través de una URL en vectores no especificados que involucran la función setScriptPath. NOTA: no está claro si este problema cruza los límites de privilegios, como los administradores podrían ya tener los privilegios para incluir ficheros arbitrarios. • http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability http://www.securitytracker.com/id/1032194 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.0EPSS: 49%CPEs: 2EXPL: 0CVE-2015-3457
https://notcve.org/view.php?id=CVE-2015-3457
Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote attackers to bypass authentication via the forwarded parameter. Magento Community Edition (CE) 1.9.1.0 y Enterprise Edition (EE) 1.14.1.0 permite a atacantes remotos eludir la autenticación a través del parámetro reenviado. • http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability http://www.securityfocus.com/bid/74420 http://www.securitytracker.com/id/1032230 • CWE-287: Improper Authentication •