Python proof-of-concept exploit for CVE-2019-7139, an unauthenticated SQL injection in Magento's product_frontend_action endpoint, enumerating databases, tables, and data.
This repository contains a proof-of-concept (PoC) exploit for CVE-2019-7139 (PRODSECBUG-2198), an unauthenticated SQL injection vulnerability in Magento, discovered by Charles Fol of Ambionics Security.
/catalog/product_frontend_action/synchronize endpoint, potentially extracting sensitive data or manipulating the database.This PoC is provided for educational purposes and security research only. It demonstrates how an attacker could exploit CVE-2019-7139 to extract database information using error-based or time-based SQL injection.
git clone https://github.com/0xSemZ/Magento-CVE-2019-7139-SQLi-PoC.git
cd Magento-CVE-2019-7139-SQLi-PoC
pip install requests
python3 exploit.py <target_url>
This code is for educational and research purposes only. Do not use it against systems without explicit permission from the system owner. The author is not responsible for any misuse or damage caused by this code. Use at your own risk.
This project is licensed under the MIT License. See the LICENSE file for details.