CVE-2020-5776

Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE via phpcli command is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI...

CVE-2020-5777

MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. A remote attacker can trigger this connection failure if the Mysql setting maxconnections default 151 is lower than Apache or...

CVE-2020-5776

Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE via phpcli command is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI...

CVE-2020-5777

MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. A remote attacker can trigger this connection failure if the Mysql setting maxconnections default 151 is lower than Apache or...

Cross site request forgery (csrf)

Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE via phpcli command is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI...

Authentication flaw

MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. A remote attacker can trigger this connection failure if the Mysql setting maxconnections default 151 is lower than Apache or...

CVE-2020-5776

Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE via phpcli command is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI...

CVE-2020-5776

CVE-2020-5776 affects MAGMI (Magento Mass Importer). MAGMI is vulnerable to cross-site request forgery (CSRF) due to lack of CSRF tokens, and CSRF could be leveraged to achieve remote code execution (RCE) via the phpcli command when an admin session is present. Affected versions include all MAGMI...

CVE-2020-5777

MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. A remote attacker can trigger this connection failure if the Mysql setting maxconnections default 151 is lower than Apache or...

CVE-2020-5777

Summary. MAGMI (Magento Mass Importer) versions before 0.7.24 are affected by a remote authentication bypass caused by default credentials being accepted when a database connection fails. The bypass can be triggered when the MySQL max_connections value is lower than the web server’s MaxRequestWor...

Magento Sites Vulnerable to RCE Stemming From Magmi Plugin Flaws

Researchers have disclosed two flaws that could enable remote code execution attacks on the Magento Mass Import Magmi plugin, an open source database client that imports data into Magento. Magmi is a Magento database client written in PHP, which is used to perform raw bulk operations on the model...

Magmi (Magento Mass Importer) <= 0.7.24 CSRF Vulnerability

Magmi is prone to a cross-site request forgery CSRF vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Magento Mass Importer < 0.7.23 Cross-Site Scripting

Magento Mass Importer Magmi is a Magento database client used to perform raw bulk operations on the models of the online store. Magento Mass Importer versions before 0.7.23 suffer from a cross-site scripting vulnerability through the prefix parameter of the /magmi/web/ajaxgettime.php URL, allowin...

VulnCheck KEV: CVE-2017-7391

A Cross-Site Scripting XSS was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data prefix passed to the 'magmi-git-master/magmi/web/ajaxgettime.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the...

34.237.203.180 Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-925450 Security Researcher Dewil Helped patch 3 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting 34.237.203.180 website and its users. Following coordinated and responsible vulnerability disclosure guidelines of the ISO...

Directory Traversal

dweeves/magmi is vulnerable to directory traversal attacks. The construct function in magmiplugin.php does not limit the input filepath to the magmi base directory...

Cross-site Scripting (XSS)

dweeves/magmi is vulnerable to cross-site scripting XSS attacks. The library does not sanitize the profile variable before rendering the profile panel, allowing a malicious user to inject and execute arbitrary webscript...

Directory Traversal

dweeves/magmi is vulnerable to directory traversal attacks. These attacks are possible because it allows attackers to put .. into the file parameter in web/ajaxpluginconf.php...

Cross-site Scripting (XSS)

Magmi is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary webscript through the profile parameter of web/magmi.php or through querystring to web/magmiimportrun.php...

Cross-Site Scripting (XSS) And Arbitrary Code Execution

dweeves/magmi-git is vulnerable to cross-site scripting XSS and arbitrary code execution attacks. The attacks are possible because user-supplied data prefix are being input to the magmi-git-master/magmi/web/ajaxgettime.php URL without enough filtering...