Executive brief
Interchange is an open-source e-commerce application server used to build online stores. An unauthenticated attacker can inject and execute arbitrary Perl code on the server through the admin quick_question feature, leading to complete server compromise. In default installations, code runs in a restricted Safe container, but can break out with non-default configuration, allowing attackers to steal data, modify the store, or launch further attacks.
Technical details
A code injection vulnerability exists in the admin quick_question page that fails to sanitize user input, allowing arbitrary Perl code injection via the "no" parameter. The vulnerability is network-accessible without authentication. While default deployments run injected code within a Safe container, deployments with the AllowGlobal directive enabled allow unrestricted code execution with full server permissions.
Affected products
- interchange Interchange
Timeline
- 2026-08-08: disclosed
- 2026-08-08: patched: Fix applied via commit 65b6ea9d3761dd1fd2071c962819562afa335e4e