Magento Shoplift (CVE-2015-1397)

Shoplift (CVE-2015-1397) is a critical vulnerability in Magento Community and Enterprise prior to the SUPEE-5344 patch (February 2015). It lets an unauthenticated attacker create an admin account on the store with a single HTTP request, which in practice means full compromise of the panel.

The flaw lives in the index.php/admin/Cms_Wysiwyg/directive/index/ endpoint. Magento processes a base64-encoded ___directive parameter without properly sanitising a product filter (popularity[from], popularity[to], popularity[field_expr]), allowing SQL injection into an internal query. The classic payload chains an INSERT into the admin_user and admin_role tables:

SET @SALT = 'rp';
SET @PASS = CONCAT(MD5(CONCAT(@SALT, '<password>')), CONCAT(':', @SALT));
INSERT INTO admin_user (firstname, lastname, email, username, password, ...) VALUES (...);
INSERT INTO admin_role (parent_id, tree_level, sort_order, role_type, user_id, role_name) VALUES (...);

That creates a user (in the public 37977.py exploit, the default creds are forme:forme) with an admin role. The password is stored as md5(salt+pass):salt, Magento 1.x's legacy format.

searchsploit -m 37977
python2 37977.py http://<ip>/    # creates the forme:forme admin

Practical note. Old exploits use a SQL comment syntax (-- ) that some recent MySQL/MariaDB versions reject; you sometimes need to clean the comment from the payload and adjust the target variable so it points at the correct index.php. Once the admin is created, panel access is usually the prelude to RCE (e.g. the FrogHopper attack or template uploads), so it naturally connects to file-upload RCE.

How to detect it. The access-log signature is a request (usually POST) to the index.php/admin/Cms_Wysiwyg/directive/index/ endpoint with a base64 ___directive parameter that, once decoded, carries the popularity[field_expr]/popularity[from] filters with SQL (SET @SALT, INSERT INTO admin_user): no legitimate panel operation uses that combination, and a WAF with Shoplift rules blocks it. The confirmation is a new row in admin_user/admin_role (DB audit) with no matching account-creation in the application logs, or a first login by that admin from an external IP.

Defence. Apply SUPEE-5344 (or upgrade to a supported branch), restrict access to the /admin panel by IP/VPN, and monitor anomalous inserts into admin_user. Magento 1.x is end-of-life: the sane move is to migrate.