CVE-2015-1397: SQL Injection

Published Apr 29, 2015

Updated

SQL injection vulnerability in the getCsvFile function in the MageAdminhtmlBlockWidgetGrid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[fieldexpr] parameter when the popularity[from] or popularity[to] parameter is set.

Affected Software

2 affected components

Magento Magento=1.9.1.0

Magento Magento=1.14.1.0

Event History

Apr 29, 2015

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-1397?

CVE-2015-1397 has a high severity rating due to its potential to allow remote SQL execution by unauthorized administrators.

How do I fix CVE-2015-1397?

To fix CVE-2015-1397, upgrade to Magento Community Edition 1.9.2 or later and Magento Enterprise Edition 1.14.2 or later to eliminate the vulnerability.

What versions of Magento are affected by CVE-2015-1397?

CVE-2015-1397 affects Magento Community Edition 1.9.1.0 and Magento Enterprise Edition 1.14.1.0.

How does CVE-2015-1397 exploit SQL injection?

CVE-2015-1397 exploits SQL injection by manipulating the popularity[field_expr] parameter, enabling execution of arbitrary SQL commands.

Who can exploit CVE-2015-1397?

CVE-2015-1397 can be exploited by remote administrators with access to the affected Magento versions.