PHP code injection in TBT_Rewards extension for Magento

1) PHP code injection

EUVDB-ID: #VU15488

Risk: Critical

CVSSv3.1: 9.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:T/RC:C]

CVE-ID: N/A

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.

The weakness exists due to PHP code injection. A remote attacker can send a specially crafted Zend_Log object and abuse PHP’s unserialize() function to inject and execute own PHP code and modify the database or any Javascript files.

Note: the vulnerability has been actively exploited by Magecart group to steal payment card data.

Mitigation

Cybersecurity Help is currently unaware of any solutions addressing the vulnerability.

Vulnerable software versions

TBT Rewards: All versions

External links

http://gwillem.gitlab.io/2018/10/23/magecart-extension-0days/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.