Cyber Posture

CVE-2011-10019

CriticalPublic PoCRCE

Published: 13 August 2025

Published
13 August 2025
Modified
24 September 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.6931 98.7th percentile
Risk Priority 61 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2011-10019 is a critical-severity Code Injection (CWE-94) vulnerability in Spreecommerce Spree. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 1.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly addresses the failure to sanitize the search[send][] parameter by requiring validation of all user inputs to prevent code injection and arbitrary command execution.

prevent

Mandates timely identification, reporting, and correction of the flaw through upgrading to Spreecommerce 0.60.2 or later, eliminating the vulnerability.

prevent

Complements input sanitization by restricting the types and volume of inputs to the search functionality, reducing the risk of exploitable malformed parameters.

NVD Description

Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute…

more

arbitrary shell commands on the server without authentication.

Deeper analysisAI

CVE-2011-10019 is a remote command execution vulnerability in Spreecommerce versions prior to 0.60.2. The flaw exists in the search functionality, where the application fails to properly sanitize user input passed via the search[send][] parameter. This input is dynamically invoked using Ruby’s send method, allowing arbitrary shell commands to be executed on the server.

The vulnerability can be exploited remotely by unauthenticated attackers with network access. By submitting crafted input to the search[send][] parameter, attackers achieve arbitrary command execution on the server, granting high confidentiality, integrity, and availability impacts as scored by CVSS v3.1 at 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Associated CWEs include CWE-94 (code injection) and CWE-1321 (improperly controlled modification of dynamically-determined object attributes).

Mitigation requires upgrading to Spreecommerce 0.60.2 or later. Relevant advisories include an archived 2011 Spreecommerce blog post detailing the remote command execution in product group search, a Vulncheck advisory on the search parameter RCE, and public exploit resources such as a Metasploit module and an Exploit-DB entry.

Exploitation is well-documented in public repositories, with a dedicated Metasploit module and Exploit-DB listing confirming proof-of-concept availability since at least 2011.

Details

CWE(s)

Affected Products

spreecommerce
spree
≤ 0.60.2

CVEs Like This One

CVE-2026-25758Same product: Spreecommerce Spree
CVE-2026-22589Same product: Spreecommerce Spree
CVE-2011-10026Same product: Spreecommerce Spree
CVE-2026-6594Shared CWE-1321, CWE-94
CVE-2026-25142Shared CWE-1321, CWE-94
CVE-2026-2964Shared CWE-1321, CWE-94
CVE-2026-6621Shared CWE-1321, CWE-94
CVE-2026-25001Shared CWE-94
CVE-2024-57083Shared CWE-1321
CVE-2026-32573Shared CWE-94

References