MAGMI plugin for Magento Unsafe File Upload
Date: 2022-05
Affected: composer/dweeves/magmi
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2014-8770
CWE: CWE-94

Unrestricted file upload vulnerability in `magmi/web/magmi.php` in the MAGMI (aka Magento Mass Importer) plugin 0.7.17a and earlier for Magento Community Edition (CE) allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file, then accessing the PHP file via a direct request to it in `magmi/plugins/`.


Mitigations:

Architectural layers (MAESTRO):