CVE-2011-10019criticalCWE-1321CWE-94

CVE-2011-10019: critical vulnerability in Spreecommerce

Spreecommerce < 0.60.2 Search Parameter RCE

Published · Updated

Follow this CVE+ Monitor Spreecommerce+ Monitor spree

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 10epss 6.3%
from disclosure to weaponsame day
Published on NVDAug 13
metasploitOct 5
In short

Spreecommerce below version 0.60.2 has a critical flaw in its search feature that lets attackers run any command on the server. The vulnerability exists because user input in the search parameter is not properly cleaned before being executed.

Technical detail

The vulnerability exploits unsafe use of Ruby's send() method on unsanitized search[send][] parameter input, enabling unauthenticated remote code execution. No special conditions are required; attackers can directly invoke arbitrary methods and execute system commands with server privileges.

Summary generated and translated by AI from the official description.
Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute arbitrary shell commands on the server without authentication.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
Spreecommerce · Spreecommerce
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Spreecommerce

In the same product, most dangerous first.

CVE-2011-10026CRITICALSpreecommerce < 0.50.x API RCEEPSS 3.8%