Critical Magento SQL Injection Flaw Could Soon Be Targeted By Hackers (csoonline.com) 14
itwbennett writes: The popular e-commerce platform Magento has released 37 security issues affecting both the commercial and open-source versions, four of which are critical. "Of those, one SQL injection flaw is of particular concern for researchers because it can be exploited without authentication," writes Lucian Constantine for CSO. Researchers from Web security firm Sucuri "have already reverse-engineered the patch [for that flaw] and created a working proof-of-concept exploit for internal testing," says Constantin. "The SQL vulnerability is very easy to exploit, and we encourage every Magento site owner to update to these recently patched versions to protect their ecommerce websites," the researchers warn in a blog post. "Unauthenticated attacks, like the one seen in this particular SQL Injection vulnerability, are very serious because they can be automated -- making it easy for hackers to mount successful, widespread attacks against vulnerable websites," the Sucuri researchers warned. "The number of active installs, the ease of exploitation, and the effects of a successful attack are what makes this vulnerability particularly dangerous." Since the researchers were able to create a working proof-of-concept exploit, it's only a matter of time until hackers discover a way to use the exploit to plant payment card skimmers on sites that have yet to install the new patch.
UPDATE: Onilab, an official Magento development partner, has a blog post explaining how you can update your store to the latest version of Magento.
UPDATE: Onilab, an official Magento development partner, has a blog post explaining how you can update your store to the latest version of Magento.
Re: Are the retard editors even trying? (Score:1)
Apparently the SQL injection was used exploited to post a dupe on slashdot.
Must be what Slashdot uses (Score:3)
Explains the dupes - injection attacks!
Warming up for April Fools' (Score:2)
Yep, the cat's out of the bag. On April 1st, it will be ALL DUPES, ALL DAY!
Pff... yeah right! (Score:3)
Come on, they've been screaming about this vulnerability on Slashdot for literally hundreds of minutes. If they haven't exploited it by now then what are the chances they are going to all of the sudden change their minds and start exploiting it in the future? ;)
My Clone Army (Score:2)
has arrived... here on slashdot.