Backport for CVE-2021-21024 Blind SQLi from Magento 2

Vulnerability

Magento-lts, a long-term support alternative to Magento Community Edition (CE), contains a vulnerability in versions prior to 19.4.13 and 20.0.9 [1]. This issue is a backport of the Magento 2 vulnerability CVE-2021-21024, which involves a Blind SQL Injection [2]. An administrator can exploit this to gain unauthorized access to restricted resources. The affected code path is reachable under standard administrative configurations.

Exploitation

An attacker needs valid administrator credentials to trigger the vulnerability [1]. The exact sequence of steps is not detailed in the public references, but the vulnerability is categorized as a Blind SQL Injection, suggesting the attacker sends crafted SQL queries through input fields or parameters that are not properly sanitized, potentially using boolean or time-based techniques to extract data [2].

Impact

Successful exploitation allows an administrator to access restricted resources beyond their intended privilege scope [1][2]. This could lead to disclosure of sensitive data stored in the database (confidentiality impact) or potentially modification of data (integrity impact), though the primary impact described is unauthorized access to restricted resources.

Mitigation

The vulnerability is patched in versions 19.4.13 and 20.0.9 of magento-lts [1][2]. Users should upgrade to these versions as soon as possible. No workarounds are mentioned in the available references. There is no indication that this CVE is listed in CISA's Known Exploited Vulnerabilities catalog.