Magento 2.2.x catalog module RCE vulnerability and POC code

漏洞概述 该漏洞涉及 Magento 2.2.x 版本中的 模块，具体为 模块中的 控制器。攻击者可以通过构造特定的请求参数，利用该漏洞执行任意代码。 影响范围 受影响版本: Magento 2.2.x 受影响模块: 受影响控制器: 控制器 修复方案 官方补丁: 升级到 Magento 2.3.x 或更高版本。 临时修复: 在 模块的 控制器中，对输入参数进行严格的验证和过滤。 POC 代码 ```php 1, 'set_filter' => 1, 'filter' => '1', 'value' => '1', 'attribute' => '1', 'store' => 1, 'category' => 1, 'product' => 1, 'price' => 1, 'qty' => 1, 'stock' => 1, 'status' => 1, 'visibility' => 1, 'type' => 1, 'name' => 1, 'description' => 1, 'short_description' => 1, 'meta_title' => 1, 'meta_keywords' => 1, 'meta_description' => 1, 'url_key' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_path' => 1, 'url_rewrite' => 1, 'url_

Goal Reached Thanks to every supporter — we hit 100%!

Magento 2.2.x catalog module RCE vulnerability and POC code

More from this source