Two modules that we tested by MyPrestaModules have a vulnerability where PHPInfo is exposed to an unauthenticated attacker. The modules SimpleImportProduct and UpdateProducts contain a file called send.php that has the following code snippet:

    if ( Tools::getValue('phpinfo') ){  
      phpinfo();  
      die;  
    }

This exposes PHPInfo information which is useful to an attacker and it requires no authentication to exploit. This was reported to MyPrestaModules and a patch was released.

Timeline