CVE-2016-4010 Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data.
CriticalCVSS 9.8
EPSS 92.9%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| magento | <= 2.0.5 | No fix listed |
References
- netanelrub.in technical-description third-party-advisory
- magento.com patch vendor-advisory
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 39838 exploit