CVE-2015-1397

EXPLOITED

Magento CE/EE 1.9.1.0-1.14.1.0 - SQL Injection

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2015-1397 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 5 public exploits from researchers including Manish Tanwar, WHOISshuvam, 0xDTC.

AI-analyzed exploit summary This exploit targets CVE-2015-1397, a SQL injection vulnerability in Magento's admin panel. It creates an admin account with credentials 'forme:forme' by injecting a malicious payload into the 'Cms_Wysiwyg' directive endpoint.

Description

SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[field_expr] parameter when the popularity[from] or popularity[to] parameter is set.

Exploits (5)

exploitdb WORKING POC
by Manish Tanwar · pythonwebappsxml
https://www.exploit-db.com/exploits/37977

This exploit targets CVE-2015-1397, a SQL injection vulnerability in Magento's admin panel. It creates an admin account with credentials 'forme:forme' by injecting a malicious payload into the 'Cms_Wysiwyg' directive endpoint.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: Magento (versions vulnerable to SUPEE-5344)
No auth needed
Prerequisites: Target Magento installation vulnerable to CVE-2015-1397 · Network access to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by WHOISshuvam · remote-auth
https://github.com/WHOISshuvam/CVE-2015-1397

This PoC exploits CVE-2015-1397, a SQL injection vulnerability in Magento's admin interface, allowing an attacker to create an admin user with arbitrary credentials. The exploit leverages a directive in the Magento admin panel to execute malicious SQL queries.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: Magento (versions prior to patch for CVE-2015-1397)
No auth needed
Prerequisites: Target Magento instance with vulnerable admin interface · Network access to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by 0xDTC · poc
https://github.com/0xDTC/Magento-eCommerce-RCE-CVE-2015-1397

This repository contains a Bash script that exploits CVE-2015-1397, a SQL injection vulnerability in Magento, to create a new admin user. The script dynamically constructs and sends a Base64-encoded payload to the vulnerable endpoint.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: Magento eCommerce (versions vulnerable to CVE-2015-1397)
No auth needed
Prerequisites: Vulnerable Magento installation · Network access to the target · Bash, curl, and base64 utilities
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by Wytchwulf · remote
https://github.com/Wytchwulf/CVE-2015-1397-Magento-Shoplift

This repository contains a two-stage exploit for CVE-2015-1397, targeting Magento CMS. The first stage (exploit.py) performs SQL injection to create an admin user, while the second stage (post_auth.py) leverages PHP object deserialization to achieve remote code execution.

Classification
Working Poc 95%
Attack Type
Sqli | Deserialization | Rce
Complexity
Moderate
Reliability
Reliable
Target: Magento CMS (versions affected by CVE-2015-1397)
No auth needed
Prerequisites: Target must be running a vulnerable version of Magento · Network access to the Magento admin panel
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by tmatejicek · poc
https://github.com/tmatejicek/CVE-2015-1397

This PowerShell script exploits CVE-2015-1397, a SQL injection vulnerability in Magento's admin interface. It crafts a malicious payload to create an admin user via the Cms_Wysiwyg directive endpoint.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: Magento (versions prior to patch for CVE-2015-1397)
No auth needed
Prerequisites: Target Magento instance with vulnerable endpoint exposed · Network access to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4

Scores

EPSS 0.7151
EPSS Percentile 98.8%

Details

VulnCheck KEV 2016-01-22
CWE
CWE-89
Status published
Products (2)
magento/magento 1.9.1.0
magento/magento 1.14.1.0
Published Apr 29, 2015
Tracked Since Feb 18, 2026