Magento Open Source and Adobe Commerce can accept a dangerous filename through guest-cart custom option file metadata while validating the supplied bytes as an image. A GIF/PHP polyglot can therefore be persisted with a PHP extension under the custom option media area. The module discovers the active store code through GraphQL. When the catalog exposes exactly one in-stock product, it also resolves the SKU automatically; catalogs with multiple candidates require the optional advanced SKU override. The vulnerable endpoint processes file metadata for an arbitrary numeric option identifier, so the module supplies an internal identifier and does not require an operator option value. The module tries the canonical Magento media routes /media and /pub/media. It proceeds only when the marker produces a dynamic PHP version and process identifier without returning PHP source. This execution condition depends on the web-server configuration; a blocked media route is not treated as proof that the upload primitive is patched. After confirming PHP interpretation and operating-system command execution, the module commits an OSCI agent. Every OSCI command is embedded in a new request-specific, token-guarded GIF/PHP polyglot that deletes itself before executing. Optional native Network-agent delivery uses curl and verifies the exit status of every installer command. By default no native Network agent is installed. The vendor CVSS vector describes user interaction. This module implements the separately published unauthenticated guest-cart laboratory path and should be used only where that endpoint and its product-option prerequisites are independently confirmed.
CVE Link
Exploit Platform
Exploit Type
Product Name