CVE-2019-16885

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In OkayCMS through 2.3.4, an unauthenticated attacker can achieve remote code execution by injecting a malicious PHP object via a crafted cookie. This could happen at two places: first in view/ProductsView.php using the cookie price_filter, and second in api/Comparison.php via the cookie comparison.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/155583/OkayCMS-2.3.4-Remote-Code-Execution.htmlExploit, Third Party Advisory
http://seclists.org/fulldisclosure/2019/Dec/15Exploit, Third Party Advisory
https://www.ait.ac.at/ait-sa-20191129-01-unauthenticated-remote-code-execution-okaycmsExploit, Third Party Advisory
http://packetstormsecurity.com/files/155583/OkayCMS-2.3.4-Remote-Code-Execution.htmlExploit, Third Party Advisory
http://seclists.org/fulldisclosure/2019/Dec/15Exploit, Third Party Advisory
https://www.ait.ac.at/ait-sa-20191129-01-unauthenticated-remote-code-execution-okaycmsExploit, Third Party Advisory

Timeline

Published: Dec 3, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-168877.8In IrfanView 4.53, Data from a Faulting Address controls a subsequent Write Address starting at image00400000+0x000000000001dcfc.CVE-2019-168897.5Ubiquiti EdgeMAX devices before 2.0.3 allow remote attackers to cause a denial of service (disk consumption) because *.cache files in /var/r CVE-2019-16897.3A vulnerability in the client application for iOS of Cisco Webex Teams could allow an authenticated, remote attacker to upload arbitrary fil CVE-2019-168905.4Halo 1.1.0 has XSS via a crafted authorUrl in JSON data to api/content/posts/comments.CVE-2019-168919.8Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.CVE-2019-168925.5In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be CVE-2019-168937.5The Web Management of TP-Link TP-SG105E V4 1.0.0 Build 20181120 devices allows an unauthenticated attacker to reboot the device via a reboot CVE-2019-168949.8download.php in inoERP 4.15 allows SQL injection through insecure deserialization.CVE-2019-168967.8In K7 Ultimate Security 16.0.0117, the module K7BKCExt.dll (aka the backup module) improperly validates the administrative privileges of the CVE-2019-168979.8In K7 Antivirus Premium 16.0.xxx through 16.0.0120; K7 Total Security 16.0.xxx through 16.0.0120; and K7 Ultimate Security 16.0.xxx through CVE-2019-168997.5In Advantech WebAccess/HMI Designer 2.1.9.31, Data from a Faulting Address controls Code Flow starting at PM_V3!CTagInfoThreadBase::GetNICIn CVE-2019-16906.5A vulnerability in the management interface of Cisco Application Policy Infrastructure Controller (APIC) software could allow an unauthentic