full-disclosure

Open Source and information security mailing list archives

Message-ID: <0DE973120EDCC24185BA1E6D916502AE70C75F36@DAG-EX10.ad.checkpoint.com>
Date: Thu, 23 Apr 2015 01:22:49 +0000
From: Shahar Tal <shahartal@...ckpoint.com>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] Magento Unauthenticated RCE

RCE on the most popular eCommerce (/shopping cart) platform out there - we have been urging admins to patch for a while now.
This one is as serious as it gets, auth bypass + SQLi + RFI converted to LFI. Props to our own Netanel Rubin for the top research.
Check Point was awarded with a $20k USD bounty for this report, which we have decided to donate to charity.

Check out the complete technical analysis at http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/

Cheers,

Shahar Tal
Malware & Vulnerability Research AAAAAAAAAAAAAAAA\0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Check Point Software Technologies | * +972-3-753-4536 | M +972-545-888887 | * shahartal@...ckpoint.com<mailto:shahartal@...ckpoint.com>

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives