Vulnerability record · CVE-2015-1397 · published 29 April 2015
CVE-2015-1397: Magento Admin Grid getCsvFile SQL Injection
MMagento · Magento
Magento Community Edition 1.9.1.0 and Enterprise Edition 1.14.1.0 contain a SQL injection flaw in the getCsvFile function of the Mage_Adminhtml_Block_Widget_Grid class. The popularity[field_expr] parameter is not properly sanitized when popularity[from] or popularity[to] is set, allowing an authenticated administrator to inject arbitrary SQL commands. This matters because it gives an admin-level attacker direct database access, which can lead to data theft or further compromise.
Description
SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[field_expr] parameter when the popularity[from] or popularity[to] parameter is set.
AV:N/AC:L/Au:S/C:P/I:P/A:P
Automated analysis
medium priorityThe flaw requires administrator authentication, limiting exposure, but public exploit activity and a high EPSS score make it a realistic risk for unpatched Magento installations.
What it is
Magento Community Edition 1.9.1.0 and Enterprise Edition 1.14.1.0 contain a SQL injection flaw in the getCsvFile function of the Mage_Adminhtml_Block_Widget_Grid class. The popularity[field_expr] parameter is not properly sanitized when popularity[from] or popularity[to] is set, allowing an authenticated administrator to inject arbitrary SQL commands. This matters because it gives an admin-level attacker direct database access, which can lead to data theft or further compromise.
Impact
An attacker with administrator privileges can execute arbitrary SQL commands against the Magento database, potentially reading, modifying, or deleting sensitive data. This could expose customer records, order information, or administrative credentials.
Attack surface
The vulnerability is reached remotely over the network through the admin interface, specifically via the getCsvFile function when the popularity[field_expr] parameter is supplied alongside popularity[from] or popularity[to]. Authentication as an administrator is required; no user interaction beyond the crafted request is needed.
Exploitation
The record does not list this CVE in CISA KEV, but EPSS shows a 30-day probability of 0.52284 (98.9th percentile), and a reference is tagged Exploit, indicating public exploit activity exists.
What to do
- Apply the vendor security patch or upgrade Magento CE/EE to a version that fixes the SQL injection in getCsvFile.
- Restrict admin panel access to trusted IP addresses and enforce strong authentication to reduce the attack surface.
- Audit administrator accounts and remove or disable unnecessary admin privileges.
- Monitor database activity for unusual SQL queries originating from the admin interface.
Detection
- Search web server and application logs for requests containing popularity[field_expr] with SQL meta-characters or unusual syntax.
- Monitor database query logs for unexpected SELECT, UNION, or stacked queries from the Magento application user.
- Alert on admin panel requests that combine popularity[from] or popularity[to] with popularity[field_expr] parameters.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2015-1397 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2015-1397), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
