Wednesday, April 12, 2017

High Risk 0-day Vulnerability Found in Magento eCommerce

During the security audit of Magento Community Edition, a highly popular e-commerce platform, a high risk vulnerability was discovered that could lead to remote code execution and thus the complete system compromise including the database containing sensitive customer information such as stored credit card numbers and other payment information. The vulnerability is based around an arbitrary file upload combined with a cross-site request forgery (CSRF) vulnerability as a main attack vector.

Despite the efforts of our team in notifying the vendor on more than one occasion since November 2016, the vulnerability remains unpatched.

Full vulnerability details are published as an advisory.

DefenseCode Team


  1. Thanks for publishing such useful information. slope

    1. I have read your article, it is very informative and helpful for me.I admire the valuable information you offer in your articles. Thanks for posting it.
      Tangki Panel
      Tangki Fiberglass
      Jual Septic Tank

  2. Yes, thanks, I've already read an article on another resource about this problem, and how to fix it. On my website, I also found this vulnerability when I installed the theme on the magento template I had to look for ways to eliminate the problem, found by chance on one resource dedicated to programming, which details how to eliminate the vulnerability

  3. Other products, such as apparel, do benefit by physical touch. And even though apparel is sold online, the lack of physical touch contributes to instances of shopping online but buying instore.Coenzyme Q10 Powder

  4. Its a pity you dont have a donate button, i would donate some =) have a peek here

  5. Very educating story, saved your site for hopes to read moreFashion Shopping in USA

  6. I like the valuable info you provide to your articles. I like the valuable info you provide to your articles. Thanks!
    Enjoy with Friv click here for games

  7. I needed to thank you for this incredible read!! I unquestionably adored each and every piece of it. I have you bookmarked your site to look at the new stuff you post. Magento extensions by Mageworx

  8. The goal of this document is to highlight the need for end-to-end solutions that seamlessly integrate.kūdikių prekės

  9. Really cool post, highly informative and professionally written and I am glad to be a visitor of this perfect blog, thank you for this rare info!
    Magento course in chennai

  10. The popular mobile platforms make people use artificial intelligence on a daily basis. A large number of people nowadays perform common tasks by talking to their machines through Google's Assistant, Apple's Siri, or Microsoft's Cortana. How to dropship

  11. Marvelous and fascinating article. Incredible things you've generally imparted to us. Much obliged. Simply keep making this kind out of the post.
    custom magento development

  12. Hi Thanks for the nice information its very useful to read your blog.
    Web Design Training

  13. Selenium is one of the most popular automated testing tool used to automate various types of applications. Selenium is a package of several testing tools designed in a way for to support and encourage automation testing of functional aspects of web-based applications and a wide range of browsers and platforms and for the same reason, it is referred to as a Suite.

    Selenium Interview Questions and Answers
    Javascript Interview Questions
    Human Resource (HR) Interview Questions

  14. This is an awesome post. Really very informative and creative contents. This concept is a good way to enhance knowledge. I like it and help me to development very well. Thank you for this brief explanation and very nice information. Well, got good knowledge.
    WordPress website development Chennai

  15. This is an awesome post. Really very informative and creative contents. This concept is a good way to enhance knowledge. I like it and help me to development very well. Thank you for this brief explanation and very nice information. Well, got good knowledge.
    WordPress website development Chennai

  16. If you're running a small-sized business and are on a tight budget, it may be better to consider other hosted eCommerce solutions such as Shopify, BigCommerce.

    Ecommerce Development in Chennai

  17. Get Shifting/Relocation Quotation from ###Packers and Movers Delhi. Packers and Movers Delhi 100% Affordable and Reliable ***Household Shifting Services. Compare Transportation Charges and Save Time, Verified and Trusted Packers and Movers in Delhi, Cheap and Safe Local, Domestic House Shifting @
    Packers and Movers Delhi

  18. This comment has been removed by the author.

  19. I admire this article for the well-researched content and excellent wording. I got so involved in this material that I couldn’t stop reading. I am impressed with your work and skill. Thank you so much.
    ecommerce website development in chennai

  20. Thanks for providing such a great Information, you can see
    Peptide Synthesis

  21. Nice post. Thanks for sharing! I want people to know just how good this information is in your article. It’s interesting content and Great work.
    Thanks & Regards,
    VRIT Professionals,
    No.1 Leading Web Designing Training Institute In Chennai.

    And also those who are looking for
    Web Designing Training Institute in Chennai
    SEO Training Institute in Chennai
    Photoshop Training Institute in Chennai
    PHP & Mysql Training Institute in Chennai
    Android Training Institute in Chennai

  22. This is the exact information I am been searching for, Thanks for sharing the required infos with the clear update and required points. To appreciate this I like to share some useful information regarding Microsoft Azure which is latest and newest,


    Azure Training in Chennai
    Azure Training center in Chennai
    Best Azure Training in Chennai
    Azure DevOps Training in Chenna
    Azure Training Institute in Chennai
    Azure Training Institute in Velachery
    Azure Training in OMR

  23. This comment has been removed by the author.

  24. Your article helped me to understand the future of .net programming language. Keep on updating your with such awesome information.

    seo training in chennai
    digital marketing course in chennai

  25. This comment has been removed by the author.

  26. Interesting information and attractive.This blog is really rocking... Yes, the post is very interesting and I really like it.I never seen articles like this. I meant it's so knowledgeable, informative, and good looking site. I appreciate your hard work. Good job.
    Kindly visit us @
    Sathya Online Shopping
    Online AC Price | Air Conditioner Online | AC Offers Online | AC Online Shopping
    Inverter AC | Best Inverter AC | Inverter Split AC
    Buy Split AC Online | Best Split AC | Split AC Online
    LED TV Sale | Buy LED TV Online | Smart LED TV | LED TV Price
    Laptop Price | Laptops for Sale | Buy Laptop | Buy Laptop Online
    Full HD TV Price | LED HD TV Price
    Buy Ultra HD TV | Buy Ultra HD TV Online
    Buy Mobile Online | Buy Smartphone Online in India

  27. Looking for latest update on TNPSC exams? Kalviseithi - #1 educational portal offer latest news about TN state government jobs, educational news and much more information.

  28. The article is very interesting and very understood to be read, may be useful for the people. I wanted to thank you for this great read!! I definitely enjoyed every little bit of it. I have to bookmarked to check out new stuff on your post. Thanks for sharing the information keep updating, looking forward for more posts..
    Kindly visit us @
    Madurai Travels
    Best Travels in Madurai
    Cabs in Madurai
    Tours and Travels in Madurai

  29. My doll offers you the best cheap real sex doll in the USA. You can customize your TPE custom sex doll by choosing her skin color, eyes, wigs, nipple color, clitoris color, removable or fixed vagina. Advance sex doll with sound and heat technology.

  30. Nice blog, Ogen Infosystem provides best Website Development and Digital Marketing Services in Delhi. For more information visit the website.
    SEO Service in Delhi

  31. Howdy, I think your blog may be having Redmi 6Pro service center in marathahalli internet browser compatibility issues. Apple iPhone X service center in marathahalli When I take a look at your site in Safari, it looks fine however, when opening in IE, it's got some overlapping issues. I just wanted to give you a quick heads up! Aside from that, excellent site! Google pixel 3xl Authorized service center in marathahalli
    Nokia 6 Plus service center in bangalore

  32. Having read this I believed it was rather informative.Samsung Galaxy S10e service center in marathahalli
    I appreciate you finding the time and effort to put this informative article together. Oppo A77 service center in marathahalli
    I once again find myself personally spending a lot of time both reading and commenting. oneplus 5T service center in marathahalli
    But so what, it was still worthwhile! Coolpad Cool Play 8 service center in marathahalli

  33. Thanks for sharing this blog. Please Keep posting like this

    Marketing Bureau Gent

    Eigen Website Maken

  34. Most Poplar Free Porn Training Center largest The coolest Free Porn Videos & Sex Movies Updated Daily. Update is a tube porn site with millions Online and offline real life porn cam

  35. The author of this post is admirable, it brings a lot of emotion to everyone reading it, let's share it more widely. I enjoyed it, thanks for posting it, I hope this post of yours will be more appreciated by it really excellent.
    friv 4 school unblocked, Jogos para crianças 2019, friv Games online 2019, cá koi mini

  36. I’m not that much of a online reader to be honest but your sites really nice, keep it up! I'll go ahead and bookmark your site to come back later on. Cheers iso certification in saudi arabia

  37. Awesome blog, visit Mutualfundwala for Mutual Fund Agent and Mutual Funds India.
    Mutual Fund Distributor

  38. Software Development Company We specialize in Blockchain development, Artificial Intelligence, DevOps, Mobile App development, Web App development and all your customised online solutions. Get best impression at online by our services, we are familiar for cost effectiveness, quality, delivery and support.