cve/2016/CVE-2016-5072.md

### [CVE-2016-5072](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5072)
![](https://img.shields.io/static/v1?label=Product&message=OXID%20eShop%20before%202016-06-13&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=RCE&color=brighgreen)

### Description

OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Fixed versions are Enterprise Edition v5.1.12, Enterprise Edition v5.2.9, Professional Edition v4.8.12, Professional Edition v4.9.9, Community Edition v4.8.12, Community Edition v4.9.9.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/OXIDprojects/patcher-2016-001