Description

The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData parameter to index.php/api/v2_soap.

Remediation

References

CVE-2015-6497

Related Vulnerabilities

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2015-3273)

WordPress Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2017-5611)

WordPress Plugin Duplicate Theme Unspecified Vulnerability (0.1.4)

Oracle Database Server CVE-2014-6467 Vulnerability (CVE-2014-6467)

Oracle JRE CVE-2012-1717 Vulnerability (CVE-2012-1717)

Severity

High

Classification

CVE-2015-6497 CWE-20 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities