HIGH

GHSA-x3gh-95p8-43qv

MAGMI plugin for Magento Unsafe File Upload

Details

Unrestricted file upload vulnerability in `magmi/web/magmi.php` in the MAGMI (aka Magento Mass Importer) plugin 0.7.17a and earlier for Magento Community Edition (CE) allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file, then accessing the PHP file via a direct request to it in `magmi/plugins/`.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/dweeves/magmi

Introduced in: 0

No fixed version published yet for dweeves/magmi (composer). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2014-8770[ADVISORY]
https://sourceforge.net/projects/magmi/files/magmi-0.7/plugins/packages[WEB]
http://www.exploit-db.com/exploits/35052[WEB]