critical9.8Public exploit code
CVE-2016-4010
Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shoppin…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Magento < 2.0.6 - Arbitrary Unserialize / Arbitrary Write File2016-05-18 · webapps · php · Verified
Impact
Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Magento | Magento | through 2.0.5 |
Weakness classification
References
- NVD record
- CVE.org record
- http://netanelrub.in/2016/05/17/magento-unauthenticated-remote-code-execution/
- https://magento.com/security/patches/magento-206-security-update
- https://packetstormsecurity.com/files/137121/Magento-Unauthenticated-Arbitrary-File-Write.html
- https://packetstormsecurity.com/files/137312/Magento-2.0.6-Unserialize-Remote-Code-Execution.html
- https://www.exploit-db.com/exploits/39838/
- http://netanelrub.in/2016/05/17/magento-unauthenticated-remote-code-execution/
- https://magento.com/security/patches/magento-206-security-update
- https://packetstormsecurity.com/files/137121/Magento-Unauthenticated-Arbitrary-File-Write.html
- https://packetstormsecurity.com/files/137312/Magento-2.0.6-Unserialize-Remote-Code-Execution.html
- https://www.exploit-db.com/exploits/39838/