CVE-2019-16885

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-12-03 · updated 2026-06-17
Weakness: CWE-94

Description

In OkayCMS through 2.3.4, an unauthenticated attacker can achieve remote code execution by injecting a malicious PHP object via a crafted cookie. This could happen at two places: first in view/ProductsView.php using the cookie price_filter, and second in api/Comparison.php via the cookie comparison.

Affected products

Okay-Cms Okaycms: through 2.3.4

References

http://packetstormsecurity.com/files/155583/OkayCMS-2.3.4-Remote-Code-Execution.html
http://seclists.org/fulldisclosure/2019/Dec/15
https://www.ait.ac.at/ait-sa-20191129-01-unauthenticated-remote-code-execution-okaycms
http://packetstormsecurity.com/files/155583/OkayCMS-2.3.4-Remote-Code-Execution.html
http://seclists.org/fulldisclosure/2019/Dec/15
https://www.ait.ac.at/ait-sa-20191129-01-unauthenticated-remote-code-execution-okaycms

Get alerted when CVE-2019-16885 or the next vulnerability affects your stack