CVE-2015-6497

HIGH

Magento < 1.9.2.1 and < 1.14.2.1 - Authenticated Remote Code Execution via Product API

Title source: llm
STIX 2.1

Description

The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData parameter to index.php/api/v2_soap.

References (5)

Core 5
Core References
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/133544/Magento-1.9.2-File-Inclusion.html
Exploit, Mailing List, Third Party Advisory x_refsource_misc
http://seclists.org/fulldisclosure/2015/Sep/48
Vendor Advisory x_refsource_misc
http://magento.com/security/patches/supee-6482
Exploit, Third Party Advisory x_refsource_misc
http://karmainsecurity.com/KIS-2015-04

Scores

CVSS v3 8.8
EPSS 0.0267
EPSS Percentile 86.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-20
Status published
Products (3)
magento/core 0 - 1.9.2.1Packagist
magento/magento < 1.14.2.1
magento/magento < 1.9.2.1
Published Jan 15, 2020
Tracked Since Feb 18, 2026