GHSA-x3gh-95p8-43qvHigh

MAGMI plugin for Magento Unsafe File Upload

Published
May 14, 2022
Last Modified
August 16, 2023

🔗 CVE IDs covered (1)

CVE-2014-8770 →

📋 Description

Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI (aka Magento Mass Importer) plugin 0.7.17a and earlier for Magento Community Edition (CE) allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file, then accessing the PHP file via a direct request to it in magmi/plugins/.

🎯 Affected products1

  • composer/dweeves/magmi:<= 0.7.17a

🔗 References (4)