CVE-2013-1656

Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the 1 paymentmethod parameter to core/app/controllers/spree/admin/paymentmethodscontroller.rb; and the 2 promotionaction parameter to...

PT-2013-3299

Name of the Vulnerable Software and Affected Versions Spree Commerce versions 1.0.x through 1.3.2 Spree Commerce versions 1.0.x before 2.0.0.rc1 Description The issue allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands. This is related t...

Spree controller Parameter Arbitrary Ruby Object Instantiation Command Execution

Spree Commerce 1.0.x before 2.0.0.rc1 allows remote authenticated administrators to instantiate arbitrary Ruby objects and executd arbitrary commands via the 1 paymentmethod parameter to core/app/controllers/spree/admin/ paymentmethodscontroller.rb; and the 2 promotionaction parameter to...