blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2015-6497

HIGH 8.8 CVSS 3.1
Published
January 15, 2020
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-20
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData parameter to index.php/api/v2_soap.

References

  • blog.mindedsecurity.com http://blog.mindedsecurity.com/2015/09/autoloaded-file-inclusion-in-magento.html Exploit, Third Party Advisory
  • karmainsecurity.com http://karmainsecurity.com/KIS-2015-04 Exploit, Third Party Advisory
  • magento.com http://magento.com/security/patches/supee-6482 Vendor Advisory
  • packetstormsecurity.com http://packetstormsecurity.com/files/133544/Magento-1.9.2-File-Inclusion.html Exploit, Third Party Advisory, VDB Entry
  • seclists.org http://seclists.org/fulldisclosure/2015/Sep/48 Exploit, Mailing List, Third Party Advisory
  • nvd.nist.gov Official NVD record