CVE-2015-1397

SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid...

6.5 MediumPublic exploit

SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[field_expr] parameter when the popularity[from] or popularity[to] parameter is set.

Exploit likelihood

55.8%Down 24.5 points since Feb 4, 2022

What each source reports

NVD Score used 6.5

Record: CVE-2015-1397
CVSS 2.0: 6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness: CWE-89
Updated: 2026-11-02

CVE List No score

Record: CVE-2015-1397
Updated: 2026-11-02

EUVDEUVD-2015-1534 No score

Record: EUVD-2015-1534
Updated: 2026-11-03

GitHub AdvisoriesGHSA-74wx-cgv2-vqc6 No score

SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid...

Record: GHSA-74wx-cgv2-vqc6
Weakness: CWE-89
Updated: 2026-11-02

Affected products

magento

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Magento eCommerce - Remote Code Execution	2015-08-26
PoC in GitHub	0xDTC/Magento-eCommerce-RCE-CVE-2015-1397	2024-11-27
PoC in GitHub	WHOISshuvam/CVE-2015-1397	2024-05-18
PoC in GitHub	Wytchwulf/CVE-2015-1397-Magento-Shoplift	2024-07-19
PoC in GitHub	tmatejicek/CVE-2015-1397	2022-04-07

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-1397 is a medium vulnerability (CVSS 6.5) in Magento, published April 29, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 55.8%, the 99th percentile. No source names a fixed version.