CVE-2019-12799

HIGH

Shopware < 5.6.0 - Insecure Deserialization

Title source: rule
STIX 2.1

Description

In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code execution. NOTE: this issue is a bypass for a CVE-2017-18357 whitelist patch.

Exploits (1)

metasploit WORKING POC EXCELLENT
by Karim Ouerghemmi, mr_me <[email protected]> · rubypocphp
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/shopware_createinstancefromnamedarguments_rce.rb

References (1)

Core 1
Core References
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://github.com/rapid7/metasploit-framework/pull/11828

Scores

CVSS v3 8.8
EPSS 0.2424
EPSS Percentile 96.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-502
Status published
Products (2)
shopware/shopware < 5.6.0
shopware/shopware 5.3.0Packagist
Published Jun 13, 2019
Tracked Since Feb 18, 2026