SUPEE 5344 patch addresses a specific remote code execution (RCE) vulnerability known as the “shoplift bug” that allows hackers to obtain Admin access to a store. Shoplift is a bug in Magento that allows a hacker to take full control of a shop, including stealing customer records and tampering with payments.

FOLLOWING ARE THE DETAILS ON THE VULNERABILITIES ADDRESSED BY THIS PATCH –

Remote code execution – APPSEC-921

  • Type: Remote Code Execution
  • CVSSv3 Severity: 9.1 (Critical)
  • Known Attacks: Yes
  • Description: Authentication bypass uses special parameter that allows the execution of Admin action. The Admin action is vulnerable to SQL injection, which allows code to be inserted into the database and executed. As a result, the store can be fully compromised by creating counterfeit administrator accounts and/or installing malware on the server.
  • Product(s) Affected: Magento CE prior to 1.9.1.1, and Magento EE prior to 1.14.2.0.
  • Fixed In: CE 1.9.1.1
  • Reporter: Netanel Rubin

To determine if your store has been patched, see the SHOPLIFT BUG TEST.