adhammedhat111/magento-cve-2019-7139-sqli-pocProof-of-Concept (PoC) exploit for CVE-2019-7139, an unauthenticated SQL injection vulnerability in Magento (PRODSECBUG-2198). For educational and security research purposes only. Use with explicit permission from system owners. Includes documentation and mitigations.
This repository contains a proof-of-concept (PoC) exploit for CVE-2019-7139 (PRODSECBUG-2198), an unauthenticated SQL injection vulnerability in Magento, discovered by Charles Fol of Ambionics Security.
/catalog/product_frontend_action/synchronize endpoint, potentially extracting sensitive data or manipulating the database.This PoC is provided for educational purposes and security research only. It demonstrates how an attacker could exploit CVE-2019-7139 to extract database information using error-based or time-based SQL injection.
git clone https://github.com/adhammedhat111/Magento-CVE-2019-7139-SQLi-PoC.git
cd Magento-CVE-2019-7139-SQLi-PoC
pip install requests
python3 exploit.py <target_url>
This code is for educational and research purposes only. Do not use it against systems without explicit permission from the system owner. The author is not responsible for any misuse or damage caused by this code. Use at your own risk.
This project is licensed under the MIT License. See the LICENSE file for details.