GitHub Advisoryadvisory · Packagist

GHSA-x3gh-95p8-43qv MAGMI plugin for Magento Unsafe File Upload

HIGH Published 2022-05-14 Modified 2023-08-07 Official page ↗
Aliases
CVE-2014-8770
Ecosystem
Packagist
Packages
dweeves/magmi
Severity
High
Weaknesses
CWE-94
Reviewed
2023-08-07

Affected packages

• Packagist dweeves/magmi: <= 0.7.17a (no fix yet)

Description

Unrestricted file upload vulnerability in `magmi/web/magmi.php` in the MAGMI (aka Magento Mass Importer) plugin 0.7.17a and earlier for Magento Community Edition (CE) allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file, then accessing the PHP file via a direct request to it in `magmi/plugins/`.

Related

Alias · CVE (1)

  • CVE-2014-8770 Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI (aka Magento Mass Importer) plugin 0.7.17a and earlier for… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References