Using Burp Suite to audit and exploit an eCommerce application
Summary: PortSwigger researchers used Burp Suite's automated crawl and scan against Magento's 'LUMA' sample site and found a number of SQL injection vulnerabilities, then verified them in Repeater and dumped the backend database via a boolean-based blind injection attack run through Intruder. The vulnerability was reported to the Magento Security Team on 15th December 2015 with the ASCII payload and database dump as proof-of-concept, and Magento patched it on January 20th 2016 and paid a bug bounty.
Key Takeaway: The researchers note that sample sites pose two threats: developers may fail to remove the sample content, or may copy its insecure coding practices into production stores - so a demo application left in place can become the template for an exploitable storefront.
Read the original at PortSwigger Research ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026