CVE-2011-10019

Name of the Vulnerable Software and Affected Versions: Spreecommerce versions prior to 0.60.2

Description: Spreecommerce versions prior to 0.60.2 contain a remote command execution issue in the search functionality. The application does not properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute arbitrary shell commands on the server without authentication.

Recommendations: Update to Spreecommerce version 0.60.2 or later.