Adobe Commerce & Magento - CosmicSting

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in arbitrary code execution. id: CVE-2024-34102 info: name: Adobe Commerce & Magento - CosmicSting author:...

magento-cve-2024-34102-exploit-cosmicstring

CVE 2024-34102 - CosmicSting XXE 漏洞影响 Adobe Commerce 与 Magento - 教育材料 本仓库包含关于 Adobe Commerce 和 Magento 最新 XML 外部实体 XXE 漏洞 的演讲幻灯片及演示材料。这些材料仅用于教育目的，旨在帮助开发者、安全专业人员及电子商务相关方了解该漏洞、其潜在影响及如何防范。 内容 幻灯片 ：漏洞概述及其工作原理 XXE 演示 ：展示 XXE 的一般工作方式 利用演示 ：展示该漏洞如何被利用 免责声明 本材料仅供 教育目的 使用。对于因使用或滥用此处提供的信息而造成的任何损害，我 不承担任何责任...

Alert: Adobe Commerce and Magento Stores Under Attack from CosmicSting Exploit

Cybersecurity researchers have disclosed that 5% of all Adobe Commerce and Magento stores have been hacked by malicious actors by exploiting a security vulnerability dubbed CosmicSting. Tracked as CVE-2024-34102 CVSS score: 9.8, the critical flaw relates to an improper restriction of XML external...

Exploit for Improper Restriction of XML External Entity Reference in Adobe Commerce

A Cosmicsting POC...

Adobe Commerce / Magento XML External Entity Injection (CosmicSting)

Adobe Magento Open Source / Commerce versions 2.4.7 2.4.7-p1, 2.4.6 2.4.6-p6, 2.4.5 2.4.5-p8, 2.4.4 2.4.4-p9 and earlier suffer from an XML External Entity XXE vulnerability. By exploiting this vulnerability and crafting a malicious XML document, a remote and unauthenticated attacker could achiev...