{"id":"CVE-2011-10019","revision":"5157fd5f0f0841258e02a2e578ff07ef","records":[{"revision":"5157fd5f0f0841258e02a2e578ff07ef","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2011-10019","aliases":[],"title":"Spreecommerce < 0.60.2 Search Parameter RCE","description":"Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute arbitrary shell commands on the server without authentication.","state":0,"publishedAt":"2025-08-13T20:53:33.577+00:00","modifiedAt":"2026-10-08T15:20:42.153+00:00","affected":[{"ecosystem":"Vendor product","name":"Spreecommerce","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unknown\",\n                    \"modules\": [\n                        \"search[send][]\",\n                        \"Kernel.fork\",\n                        \"eval\"\n                    ],\n                    \"product\": \"Spreecommerce\",\n                    \"vendor\": \"Spreecommerce\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"0.60.2\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:gem/spree\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":10,"severity":"CRITICAL"}],"references":["https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/spree_search_exec.rb","https://www.exploit-db.com/exploits/17941","https://web.archive.org/web/20111009192436/http://spreecommerce.com/blog/2011/10/05/remote-command-product-group/","https://www.vulncheck.com/advisories/spreecommerce-search-parameter-rce","https://github.com/orgs/spree"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2011-10019","license":"CVE Program Terms of Use","key":"cve-program:CVE-2011-10019","identifiers":["CVE-2011-10019"]},"retained":false,"historicalAffected":[]}],"coverage":[]}