CVE-2019-16885

In OkayCMS through 2.3.4, an unauthenticated attacker can achieve remote code execution by injecting a malicious PHP object via a crafted cookie. This could happen at two places: first in view/ProductsView.php using the cookie pricefilter, and second in api/Comparison.php via the cookie compariso...

PT-2019-14844

Name of the Vulnerable Software and Affected Versions OkayCMS versions prior to 2.3.5 Description The issue allows an unauthenticated attacker to achieve remote code execution by injecting a malicious PHP object via a crafted cookie. This can occur in two places: first in view/ProductsView.php...

CVE-2019-16885: Improper Control of Generation of Code

In OkayCMS through 2.3.4, an unauthenticated attacker can achieve remote code execution by injecting a malicious PHP object via a crafted cookie. This could happen at two places: first in view/ProductsView.php using the cookie pricefilter, and second in api/Comparison.php via the cookie compariso...