Administrators of Magento e-commerce websites have to update their installations due to the presence of a critical SQL injection vulnerability in the popular CMS.
The flaw could have a significant impact considering that roughly 28% of websites on the Internet are based on the popular open source e-commerce platform.
This week Magento released new versions of to address a total of 37 security vulnerabilities.
The company addressed Remote Code Execution (RCE), Cross-Site Scripting (XSS) and other issues, most of them could only be exploited by authenticated users. Experts pointed out that the most severe flaw addressed in this round is an SQL Injection vulnerability, that can be exploited by unauthenticated, remote attackers.
The vulnerability, internally tracked as “PRODSECBUG-2198,” could be exploited by remote attackers to steal sensitive information from the databases of vulnerable e-commerce sites. The flaw could be exploited to steal admin sessions or password hashes that could allow attackers to access to the admin’s dashboard.
“Magento Commerce and Open Source 2.3.1, 2.2.8 and 2.1.17 contain multiple security enhancements that help close Remote Code Execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities.” reads the security advisory published by Magento.
“An unauthenticated user can execute arbitrary code through an SQL injection vulnerability, which causes sensitive data leakage.”
The versions of the CMS affected by the flaw include:
Administrators of e-commerce websites running on vulnerable versions of the CMS have to install the latest version as soon as possible.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – CMS, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Microsoft Patch Tuesday security updates for May 2025 addressed 75 security flaws across multiple products, including…
Fortinet fixed a critical remote code execution zero-day vulnerability actively exploited in attacks targeting FortiVoice…
Interlock Ransomware 's attack on a defense contractor exposed global defense supply chain details, risking…
Marks and Spencer (M&S) confirms that threat actors stole customer data in the ransomware attack…
A 45-year-old foreign man has been arrested in Moldova for allegedly participating in ransomware attacks…
A Türkiye-linked group used an Output Messenger zero-day to spy on Kurdish military targets in…
This website uses cookies.
![](data:image/svg+xml;charset=utf-8,<svg height="483px" width="980px" xmlns="http://www.w3.org/2000/svg" version="1.1"/>)