| Package | Affected versions | Patched versions |
|---|---|---|
| rd_searchlogic | ≤ 3.0.1 | |
| spree | ≥ 0.30.0.beta1, < 0.50.0 | 0.50.0 |
| spree | < 0.50.1 | 0.50.1 |
Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search functionality. Improper input sanitation allows attackers to inject arbitrary shell commands via the search[instance_eval] parameter, which is dynamically invoked using Ruby’s send method. This flaw enables unauthenticated attackers to execute commands on the server.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free