CVE-2015-1397
MEDIUM 6.5EPSS 55.8%
SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[field_expr] parameter when the popularity[from] or popularity[to] parameter is set.
- CVSS v2.0 NVD
- 6.5 MEDIUM
AV:N/AC:L/Au:S/C:P/I:P/A:P - EPSS
- 55.77% chance of exploitation in the next 30 days, 99th percentile
- Published
- 2015-04-29
- Updated
- 2024-08-06
Proof-of-concept exploits (5)
- 0xDTC/Magento-eCommerce-RCE-CVE-2015-13970★ · 2025-01-07
- Hackhoven/Magento-Shoplift-Exploit2★ · 2024-03-10
- WHOISshuvam/CVE-2015-13971★ · 2024-05-18
- Wytchwulf/CVE-2015-1397-Magento-Shoplift0★ · 2024-07-19
- tmatejicek/CVE-2015-13970★ · 2022-04-07