Magento Blind SQL Injection in the Search module

The SQL injection vulnerability in Magento's Search module poses a significant risk. An attacker, possessing administrative access, can craft malicious queries to extract sensitive data directly from the database. This could include customer Personally Identifiable Information (PII) such as names, addresses, credit card details (if stored), order history, and potentially even administrative credentials. Beyond data exfiltration, the attacker could manipulate data, leading to fraudulent orders, account takeovers, or denial of service. The blind nature of the injection means the attacker doesn't directly see the results of their queries, requiring more sophisticated techniques to extract information, but doesn't inherently limit the potential impact. This vulnerability shares characteristics with other database injection flaws, highlighting the importance of parameterized queries and input validation.

Organizations running Magento Community Edition versions 2.3.6 and earlier, particularly those with publicly accessible admin consoles and inadequate security measures, are at significant risk. Shared hosting environments utilizing Magento are also vulnerable, as they may lack control over the underlying server configuration and patching process.

• php / server:

find /var/www/html -name 'app/code/Magento/Search/Model/Adapter/Mysql.php' -exec grep -i 'query(' {} + | grep -i 'SELECT' 

• php / server:

journalctl -u php-fpm -f | grep -i "SQL injection"

• generic web:

curl -I https://your-magento-site.com/search?q=' OR 1=1 --silent | grep -i '200 OK'

1. 2021-12-16Discovery

   discovery

2. 2022-05-24Disclosure

   disclosure

3. 2022-05-24Patch

   patch

Dernière mise à jour

2.4.9récemment

1. Réservé2020-12-18
2. Publiée2022-05-24
3. Modifiée2024-02-16
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2021-21024 is to immediately upgrade to Magento Community Edition version 2.3.6-p1 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict access to the admin console using strong passwords and multi-factor authentication. Implement a Web Application Firewall (WAF) with rules to detect and block SQL injection attempts targeting the Search module endpoints. Carefully review and validate all user inputs related to search functionality. Monitor Magento logs for suspicious activity, specifically looking for unusual database queries originating from the Search module. After upgrading, confirm the vulnerability is resolved by attempting a test SQL injection payload against the Search module and verifying that it is properly sanitized.