What is CVE-2016-5072?

CVE-2016-5072 is a high-severity vulnerability in Oxidforge Oxid Eshop, classified under Code Injection. CVSS score: 8.8/10. Published 2017-04-10.

How severe is CVE-2016-5072?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2016-5072 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Oxidforge Oxid Eshop

CVE-2016-5072

OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Fixed versions are Enterprise Edition v5.1.12, Enterprise Edition v5.2.9, Professional Edition v4.8.12, Professional Edition v4.9.9, Community Edition v4.8.12, Community Edition v4.9.9.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.019 (77.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Oxidforge Oxid_eshop
N/a Oxid Eshop Before 2016-06-13 — versions OXID eShop before 2016-06-13

Weakness classification (CWE)

CWE-94 — Code Injection

Public proof-of-concept exploits

References

cret@cert.org (Patch, x_refsource_MISC, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2016-5072?: CVE-2016-5072 is a high-severity vulnerability in Oxidforge Oxid Eshop, classified under Code Injection. CVSS score: 8.8/10. Published 2017-04-10.
How severe is CVE-2016-5072?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2016-5072 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.