spree 'rd_searchlogic' Remote Command Execution Vulnerability

http://www.securityfocus.com/bid/47543

Security Info

Bugtraq ID:	47543
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Apr 22 2011 12:00AM
Updated:	Apr 22 2011 12:00AM
Credit:	joernchen
Vulnerable:

Not Vulnerable:

Security Discussion

spree is prone to a remote command-execution vulnerability.

An attacker can exploit this issue to execute arbitrary commands in the context of a user running the affected webserver.

spree versions prior to 0.50.1 are vulnerable.

Proof of Concept and Security Exploits

The following exploit is available:

/data/vulnerabilities/exploits/47543.rb

Security Solution(s)

Solution:
Updates are available. Please see the references for more details.

Security References(s)

References:

Spree Homepage (Spree)
Spree Security Fix - 0.50.1 Release (Spree)

Emagined Security Blog featuring Dr. Eugene Schultz

Secure Web Programming
by Vizual Services