SUPEE 5344 patch addresses a specific remote code execution (RCE) vulnerability known as the “shoplift bug” that allows hackers to obtain Admin access to a store. Shoplift is a bug in Magento that allows a hacker to take full control of a shop, including stealing customer records and tampering with payments.
FOLLOWING ARE THE DETAILS ON THE VULNERABILITIES ADDRESSED BY THIS PATCH –
Remote code execution – APPSEC-921
Type: Remote Code Execution
CVSSv3 Severity: 9.1 (Critical)
Known Attacks: Yes
Description: Authentication bypass uses special parameter that allows the execution of Admin action. The Admin action is vulnerable to SQL injection, which allows code to be inserted into the database and executed. As a result, the store can be fully compromised by creating counterfeit administrator accounts and/or installing malware on the server.
Product(s) Affected: Magento CE prior to 184.108.40.206, and Magento EE prior to 220.127.116.11.