HTTP: Magento Cms_Wysiwyg SQL Injection
This signature detects attempts to exploit a known vulnerability against Magento. A successful attack can lead to command injection and arbitrary code execution.
Extended Description
SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[field_expr] parameter when the popularity[from] or popularity[to] parameter is set.
Affected Products
Magento magento
References
CVE: CVE-2015-1397
Short Name
HTTP:SQL:INJ:MAGENTO-CMS-WYSIWY
Severity
Minor
Recommended
False
Recommended Action
Drop
Category
HTTP
Keywords
CVE-2015-1397 Cms_Wysiwyg Injection Magento SQL
Release Date
03/03/2020
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3337
False Positive
Unknown
Vendors
Magento
CVSS Score
6.5