OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Fixed versions are Enterprise Edition v5.1.12 Enterprise Edition v5.2.9 Professional Edition v4.8.12 Professional Edition v4.9.9 Community Edition v4.8.12 Community Edition v4.9.9.