CVE-2011-10026 Spreecommerce < 0.50.x API RCE
CriticalCVSS 9.3
EPSS 4.0%
Framework module
Public exploit
PoC
- Published
- Updated
- Exploit status
- Public exploit available
Description
Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search functionality. Improper input sanitation allows attackers to inject arbitrary shell commands via the search[instance_eval] parameter, which is dynamically invoked using Ruby’s send method. This flaw enables unauthenticated attackers to execute commands on the server.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems spree(RubyGems) | >= 0.30.0.beta1, < 0.50.0 | 0.50.0 |
| rubygems spree(RubyGems) | = 0.30.0 | No fix listed |
| rubygems spree(RubyGems) | = 0.30.0.beta1 | No fix listed |
| rubygems spree(RubyGems) | = 0.30.1 | No fix listed |
| rubygems spree(RubyGems) | = 0.30.2 | No fix listed |
| rubygems spree(RubyGems) | = 0.40.0 | No fix listed |
| rubygems spree(RubyGems) | = 0.40.1 | No fix listed |
| rubygems spree(RubyGems) | = 0.40.2 | No fix listed |
| rubygems spree(RubyGems) | = 0.40.3 | No fix listed |
| rubygems spree(RubyGems) | = 0.40.4 | No fix listed |
| rubygems rd_searchlogic(RubyGems) | <= 3.0.1 | No fix listed |
| rubygems rd_searchlogic(RubyGems) | = 3.0.0 | No fix listed |
| rubygems rd_searchlogic(RubyGems) | = 3.0.0.rc | No fix listed |
| rubygems rd_searchlogic(RubyGems) | = 3.0.0.rc2 | No fix listed |
| rubygems rd_searchlogic(RubyGems) | = 3.0.0.rc3 | No fix listed |
| rubygems rd_searchlogic(RubyGems) | = 3.0.0.rc4 | No fix listed |
| rubygems rd_searchlogic(RubyGems) | = 3.0.1 | No fix listed |
| Spreecommerce | All versions | No fix listed |
| spreecommerce spree | < 0.50.1 | 0.50.1 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com exploit
- github.com exploit
- github.com product
- github.com product
- raw.githubusercontent.com exploit third-party-advisory
- web.archive.org patch vendor-advisory
- www.exploit-db.com exploit vdb-entry
- www.vulncheck.com third-party-advisory
- github.com