CVE-2011-10019
CRITICALSpreecommerce < 0.60.2 - Unauthenticated Remote Code Execution via Search Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2011-10019.
PoCs published by Metasploit, including Metasploit module exploits/multi/http/spree_search_exec.
AI-analyzed exploit summary This Metasploit module exploits an arbitrary command execution vulnerability in Spreecommerce 0.60.1 by leveraging unvalidated input passed via the Ruby `send` method. The exploit sends a crafted HTTP GET request with a payload that triggers command execution through `Kernel.fork` and `eval`.
Description
Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute arbitrary shell commands on the server without authentication.
Exploits (2)
This Metasploit module exploits an arbitrary command execution vulnerability in Spreecommerce 0.60.1 by leveraging unvalidated input passed via the Ruby `send` method. The exploit sends a crafted HTTP GET request with a payload that triggers command execution through `Kernel.fork` and `eval`.
This Metasploit module exploits an arbitrary command execution vulnerability in Spreecommerce 0.60.1 by leveraging unvalidated input passed to the Ruby `send` method. The exploit crafts a malicious URI to execute arbitrary commands via `Kernel.fork` and `eval`.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H