[FD] Magento Unauthenticated RCE

[Shahar Tal <shahartal@xxxxxxxxxxxxxx>]

RCE on the most popular eCommerce (/shopping cart) platform out there - we have 
been urging admins to patch for a while now.
This one is as serious as it gets, auth bypass + SQLi + RFI converted to LFI. 
Props to our own Netanel Rubin for the top research.
Check Point was awarded with a $20k USD bounty for this report, which we have 
decided to donate to charity.

Check out the complete technical analysis at 
http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/

Cheers,

Shahar Tal
Malware & Vulnerability Research 
AAAAAAAAAAAAAAAA\0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Check Point Software Technologies | * +972-3-753-4536 | M +972-545-888887 | * 
shahartal@xxxxxxxxxxxxxx<mailto:shahartal@xxxxxxxxxxxxxx>


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/