CVE-2019-16885
9.8
CRITICAL · CVSS 3.1 · EPSS 4.6% (pctl 91)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
In OkayCMS through 2.3.4, an unauthenticated attacker can achieve remote code execution by injecting a malicious PHP object via a crafted cookie. This could happen at two places: first in view/ProductsView.php using the cookie price_filter, and second in api/Comparison.php via the cookie comparison.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 4.6% — more likely to be exploited than 91% of all CVEs |
| Weakness | CWE-94 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2019-12-03 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| okay-cms | okaycms |
References
- http://packetstormsecurity.com/files/155583/OkayCMS-2.3.4-Remote-Code-Execution.html
- http://seclists.org/fulldisclosure/2019/Dec/15
- https://www.ait.ac.at/ait-sa-20191129-01-unauthenticated-remote-code-execution-okaycms
- http://packetstormsecurity.com/files/155583/OkayCMS-2.3.4-Remote-Code-Execution.html
- http://seclists.org/fulldisclosure/2019/Dec/15
- https://www.ait.ac.at/ait-sa-20191129-01-unauthenticated-remote-code-execution-okaycms
→ the Explorer · watch your stack · NVD