Magento Mage_Adminhtml_Block_Report_Search_Grid Class 'popularity' Parameter SQLi

medium Nessus Plugin ID 83304

Language:

Synopsis

The remote web server is running a PHP application that is affected by a SQL injection vulnerability.

Description

The Magento application running on the remote web server is affected by a SQL injection vulnerability due to failing to properly sanitized the user-supplied range inputs to the 'popularity' parameter of the Mage_Adminhtml_Block_Report_Search_Grid class. An unauthenticated, remote attacker can exploit this to execute arbitrary SQL statements against the back-end database, leading to the execution of arbitrary code, manipulation of data, or disclosure of sensitive information.

Note that the application is reportedly also affected by an authentication bypass vulnerability as well as a remote file-include vulnerability. The attack demonstrated here chains the authentication bypass vulnerability with the SQL injection vulnerability to execute a SQL query against the back-end database.

Solution

Apply the SUPEE-5344 security patch.

Plugin Details

Severity: Medium

ID: 83304

File Name: magento_shoplift_sql_injection.nasl

Version: 1.8

Type: remote

Family: CGI abuses

Published: 5/11/2015

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS Score Source: CVE-2015-1397

Vulnerability Information

CPE: cpe:/a:magentocommerce:magento, cpe:/a:magento:magento

Required KB Items: www/PHP, installed_sw/Magento

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/9/2015

Vulnerability Publication Date: 4/20/2015

Reference Information

CVE: CVE-2015-1397

BID: 74298

Detections

Analytics