CVE-2014-8770 MAGMI plugin for Magento Unsafe File Upload
HighCVSS 9.0
EPSS 6.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI (aka Magento Mass Importer) plugin 0.7.17a and earlier for Magento Community Edition (CE) allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file, then accessing the PHP file via a direct request to it in magmi/plugins/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dweeves/magmi(Packagist) | <= 0.7.17a | No fix listed |
| magmi project magmi | <= 0.7.17a | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- sourceforge.net
- 35052 exploit third-party-advisory vdb-entry
- github.com
- 113848 broken-link vdb-entry