Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute arbitrary shell commands on the server without authentication.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Public exploits 1
- Spreecommerce 0.60.1 Arbitrary Command Execution (exploit module) Metasploit · verified · 2011-10-05
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Change history 1
- First seenCVSS 10.0 · spreecommerceNVD modified 2026-10-08 16:16
Affected (CPE criteria) 1
cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*
References 5
- https://github.com/orgs/spree Product
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/spree_search_exec.rb Exploit, Third Party Advisory
- https://web.archive.org/web/20111009192436/http://spreecommerce.com/blog/2011/10/05/remote-command-product-group/ Release Notes
- https://www.exploit-db.com/exploits/17941 Exploit, VDB Entry
- https://www.vulncheck.com/advisories/spreecommerce-search-parameter-rce Third Party Advisory