CVEvulnerability
CVE-2015-6497
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-01-15
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-20
Description
The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData parameter to index.php/api/v2_soap.
Affected configurations
• magento magento (< 1.9.2.1)
• magento magento (< 1.14.2.1)
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://blog.mindedsecurity.com/2015/09/autoloaded-file-inclusion-in-magento.html Exploit, Third Party Advisory
- http://karmainsecurity.com/KIS-2015-04 Exploit, Third Party Advisory
- http://magento.com/security/patches/supee-6482 Vendor Advisory
- http://packetstormsecurity.com/files/133544/Magento-1.9.2-File-Inclusion.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2015/Sep/48 Exploit, Mailing List, Third Party Advisory
- http://blog.mindedsecurity.com/2015/09/autoloaded-file-inclusion-in-magento.html Exploit, Third Party Advisory
- http://karmainsecurity.com/KIS-2015-04 Exploit, Third Party Advisory
- http://magento.com/security/patches/supee-6482 Vendor Advisory
- http://packetstormsecurity.com/files/133544/Magento-1.9.2-File-Inclusion.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2015/Sep/48 Exploit, Mailing List, Third Party Advisory