) auf die Platte geschrieben -> Webshell.
// Bewusst nicht auf "pearcmd" als Keyword eingeschraenkt, da sich das Angriffsziel (jede per
// Path Traversal erreichbare, includebare Datei) aendern kann -> generisch auf "../.." und "<?".
$mc_waf_pearLang = isset($_GET['lang']) && is_string($_GET['lang']) ? $_GET['lang'] : '';
$mc_waf_pearQs   = isset($_SERVER['QUERY_STRING']) ? $_SERVER['QUERY_STRING'] : '';
if (
    $mc_waf_pearLang !== ''
    && strpos($mc_waf_pearLang, '../..') !== false
    && (
        strpos($mc_waf_pearQs, '<?') !== false
        || strpos(urldecode($mc_waf_pearQs), '<?') !== false
    )
) {
    file_put_contents("/tmp/mc-microwaf.log",
        date('Y-m-d H:i:s')
        . " - CVE-2026-87902: Blocked pearcmd LFI/RCE attempt"
        . " from " . $_SERVER['REMOTE_ADDR']
        . " (X-Forwarded-For: " . $mc_waf_xForwardedFor . ") "
        . "to " . $_SERVER['REQUEST_URI']
        . "\n", FILE_APPEND | LOCK_EX);
    mc_waf_block('CVE-2026-87902');
}

//StyleSmuggler: https://sansec.io/research/stylesmuggler
// Portierung der nginx-/VCL-Regeln (accord_rce).
// 1. Block "/paypal/transparent/response/"
if (stripos($_SERVER['REQUEST_URI'], '/paypal/transparent/response/') !== false) {
    mc_waf_block('StyleSmuggler', 'VCL');
}

// Layer 0/1: Query-String, routenunabhaengig.
// Keine Admin-Ausnahme wie in der VCL, weil der Admin-Frontname pro Installation
// individuell ist und sich nicht generisch erkennen laesst.
$mc_waf_ssQs = isset($_SERVER['QUERY_STRING']) ? $_SERVER['QUERY_STRING'] : '';
if ($mc_waf_ssQs !== '') {
    // drei Paesse kollabieren bis zu 3-fach-Encoding, qs2 dient als Rest-%-Detektor fuer >=4x
    $mc_waf_ssQs2 = urldecode(urldecode($mc_waf_ssQs));
    $mc_waf_ssQs3 = urldecode($mc_waf_ssQs2);

    // Layer 0: PHP-Open-Tag im QS (Stage-1A File-Plant)
    if (strpos($mc_waf_ssQs3, '<?') !== false) {
        mc_waf_block('StyleSmuggler-L0', 'VCL');
    }

    // Layer 1a: styles[] in jeder Encoding-Tiefe.
    // $_GET-Key deckt einfaches Encoding ab, weil PHP vor dem Klammer-Parsing dekodiert.
    if (
        isset($_GET['styles'])
        || preg_match('@styles\s*\[@i', $mc_waf_ssQs3)
        || preg_match('@styles\s*%@i', $mc_waf_ssQs2)
    ) {
        mc_waf_block('StyleSmuggler-L1a', 'VCL');
    }

    // Layer 1b: Template-Direktive in text-Parametern (text=, text[]=, text[0]=, ...)
    // [\s+]* statt \s*, weil ein Leerzeichen im QS als '+' ankommt
    if (
        stripos($mc_waf_ssQs3, '{{') !== false
        && preg_match('@(^|[&;])text[^=&;]*=[^&;]*\{\{[\s+]*(block|widget|layout|config|template|store|trans|media|view|var|if|depend|inlinecss|css|customvar|for|protocol)\b@i', $mc_waf_ssQs3)
    ) {
        mc_waf_block('StyleSmuggler-L1b', 'VCL');
    }
}

// Layer 2: Request-Body
if ($_SERVER['REQUEST_METHOD'] === 'POST' || $_SERVER['REQUEST_METHOD'] === 'PUT') {
    $mc_waf_ssBody = $mc_waf_input;
    if ($mc_waf_ssBody === '' && !empty($_POST)) {
        // php://input ist bei multipart/form-data leer
        $mc_waf_ssBody = http_build_query($_POST);
    }

    // ohne ^-Anker: faengt Store-Code-Praefixe, /index.php/... und Unterverzeichnis-Installationen
    // zweite Alternative deckt JSON-Notation ab, auch mit escapten Quotes in verschachtelten Strings
    if (
        preg_match('@(^|/)(graphql|paypal|rest|sales|multishipping|newsletter)(/|\?|$)@i', $_SERVER['REQUEST_URI'])
        && preg_match('@styles\s*(\[|%5b)|\\\\?"styles\\\\?"\s*:\s*\[@i', $mc_waf_ssBody)
    ) {
        mc_waf_block('StyleSmuggler-L2b', 'VCL');
    }

    // engere Routenliste als bei L2b: /rest, /sales und /newsletter fuehren im Backend
    // legitim Direktiven im Body (CMS-API, Newsletter-Templates, Order-Comments)
    if (
        preg_match('@(^|/)(graphql|paypal|multishipping)(/|\?|$)@i', $_SERVER['REQUEST_URI'])
        && stripos($mc_waf_ssBody, '{{') !== false
        && preg_match('@\{\{[\s+]*(block|widget|layout|config|template|store|trans|media|view|var|if|depend|inlinecss|css|customvar|for|protocol)\b@i', $mc_waf_ssBody)
    ) {
        mc_waf_block('StyleSmuggler-L2a', 'VCL');
    }
}<!DOCTYPE html>
<html class="no-js" lang="de" itemscope="itemscope" itemtype="https://schema.org/WebPage">
<head>
<meta charset="utf-8">
<meta name="author" content="Brogsitter Weinversand" />
<meta name="robots" content="index,follow" />
<meta name="revisit-after" content="7 days" />
<meta name="keywords" content="Premium, Pastasauce, 100, natürlichen, Zutaten, Produziert, 100-jährigem, Rezept, Familie, Musikers, Jon, Bon, Jovi
Inhalt:, 400g" />
<meta name="description" content="Premium Pastasauce mit 100 % natürlichen Zutaten Produziert nach einem 100-jährigem Rezept der Familie des Musikers Jon Bon Jovi
Inhalt: 400g" />
<meta property="og:type" content="product"/>
<meta property="og:site_name" content="Brogsitter B2B"/>
<meta property="og:url" content="https://www.b2b-brogsitter.de/pastasauce-arrabbiata-tomatensauce-mit-chili"/>
<meta property="og:title" content="Pastasauce Arrabbiata Tomatensauce mit Chili"/>
<meta property="og:description" content="Premium Pastasauce mit 100 % natürlichen Zutaten Produziert nach einem 100-jährigem Rezept der Familie des Musikers Jon Bon Jovi
Inhalt: 400g"/>
<meta property="og:image" content="https://www.b2b-brogsitter.de/media/image/62/85/44/200798.png"/>
<meta property="product:brand" content="BONGIOVI"/>
<meta property="product:product_link" content="https://www.b2b-brogsitter.de/pastasauce-arrabbiata-tomatensauce-mit-chili"/>
<meta name="twitter:card" content="product"/>
<meta name="twitter:site" content="Brogsitter B2B"/>
<meta name="twitter:title" content="Pastasauce Arrabbiata Tomatensauce mit Chili"/>
<meta name="twitter:description" content="Premium Pastasauce mit 100 % natürlichen Zutaten Produziert nach einem 100-jährigem Rezept der Familie des Musikers Jon Bon Jovi
Inhalt: 400g"/>
<meta name="twitter:image" content="https://www.b2b-brogsitter.de/media/image/62/85/44/200798.png"/>
<meta itemprop="copyrightHolder" content="Brogsitter B2B" />
<meta itemprop="copyrightYear" content="2014" />
<meta itemprop="isFamilyFriendly" content="True" />
<meta itemprop="image" content="https://www.b2b-brogsitter.de/media/image/94/f8/bd/BRO_B2B_Vertikal_alternativ_Positiv_4C7zOO1QMHobyu9.png" />
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta name="mobile-web-app-capable" content="yes">
<meta name="apple-mobile-web-app-title" content="Brogsitter B2B">
<meta name="apple-mobile-web-app-capable" content="yes">
<meta name="apple-mobile-web-app-status-bar-style" content="default">
<script async src="https://cdn.wein.cc/static/v5/x.js"></script>
<script>
// Save data into LocalStorage
window.weinccdata = window.weinccdata || [];
function weincc(){weinccdata.push(arguments);}
weincc({
'command'   : 'clickthrough',
'ttl': '90'
});
</script>
<link rel="apple-touch-icon-precomposed" href="https://www.b2b-brogsitter.de/media/image/6a/37/3d/Brogsitter_favicon.png">
<link rel="shortcut icon" href="https://www.b2b-brogsitter.de/media/image/6a/37/3d/Brogsitter_favicon.png">
<meta name="msapplication-navbutton-color" content="#be9e55" />
<meta name="application-name" content="Brogsitter B2B" />
<meta name="msapplication-starturl" content="https://www.b2b-brogsitter.de/" />
<meta name="msapplication-window" content="width=1024;height=768" />
<meta name="msapplication-TileImage" content="https://www.b2b-brogsitter.de/media/image/6a/37/3d/Brogsitter_favicon.png">
<meta name="msapplication-TileColor" content="#be9e55">
<meta name="theme-color" content="#be9e55" />
<link rel="canonical" href="https://www.b2b-brogsitter.de/pastasauce-arrabbiata-tomatensauce-mit-chili" />
<title itemprop="name">
Pastasauce Arrabbiata Tomatensauce mit Chili | Artikel | Brogsitter B2B</title>
<link href="/web/cache/1782139898_a50793782547371b9f0b76dfd075e6b1.css" media="all" rel="stylesheet" type="text/css" />
<link rel="stylesheet" href="/themes/Frontend/Brogsitter/frontend/_public/src/css/font-awesome.min.css"/>
<link href="/themes/Frontend/Brogsitter/frontend/_public/src/fonts/material-icons.css" rel="stylesheet">
<link href="/engine/Shopware/Plugins/Local/Frontend/BrogsitterShopware5HerstellerEinkaufsweltenelement/Views/frontend/brher/_public/src/css/brogsitter-emotion-supplier.css" rel="stylesheet" type="text/css">
<script>var bilobaGtagjsConfig = window.bilobaGtagjsConfig = {"currency":"EUR","currentConsentManager":"shopwareCookieConsentManager","dataAttributeForCustomConsentManagers":null,"debug_mode_enabled":true,"enable_advanced_conversion_data":true,"enabled":false,"ga_anonymizeip":true,"ga_id":"G-YYTKEQ5Q3T","ga_optout":true,"gaw_conversion_id":"965702328","gaw_id":"AW-965702328","google_business_vertical":"retail","respect_dnt":true,"cookie_note_mode":1,"show_cookie_note":true};</script>
<script>var dv_accessibility_options = {"language":"de","standardToolPosition":6,"openToolKey":"ctrlQ","filters":{"height":"","displayBlock":".cart--amount,.cart--display,.cart--quantity","lineHeight":".account--display,.filter-panel--title,.navigation--signin-btn,.cart--amount,.cookie-permission--decline-button,.cookie-permission--configure-button,.cart--display","wrapInput":".main-search--form"},"enabledModules":{"keyboardNav":"1","contrast":"1","highlightLinks":"1","biggerText":"1","textSpacing":"1","legibleFonts":"1","bigCursor":"1","readingGuide":"1","tooltips":"1","pauseAnimations":"1"},"enableResetButton":"1","enablePageStructureButton":"1","enablePositionButton":"1","moduleKeyboardNav":{"frameColor":"#ff0000"},"moduleContrast":{"useInverseColors":"1","useDarkContrast":"1","useLightContrast":"1","useDesaturate":"1"},"moduleHighlightLinks":{"color":"#ffff00","background":"#00d111","highlightColor":"#000000"},"moduleLegibleFonts":["dvaccess-legible-fonts","dvaccess-legible-fonts-1"],"moduleBigCursor":{"imageURL":"data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48IURPQ1RZUEUgc3ZnIFBVQkxJQyAiLS8vVzNDLy9EVEQgU1ZHIDEuMS8vRU4iICJodHRwOi8vd3d3LnczLm9yZy9HcmFwaGljcy9TVkcvMS4xL0RURC9zdmcxMS5kdGQiPjxzdmcgdmVyc2lvbj0iMS4xIiBpZD0iTGF5ZXJfMSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxuczp4bGluaz0iaHR0cDovL3d3dy53My5vcmcvMTk5OS94bGluayIgeD0iMHB4IiB5PSIwcHgiIHdpZHRoPSIyOS4xODhweCIgaGVpZ2h0PSI0My42MjVweCIgdmlld0JveD0iMCAwIDI5LjE4OCA0My42MjUiIGVuYWJsZS1iYWNrZ3JvdW5kPSJuZXcgMCAwIDI5LjE4OCA0My42MjUiIHhtbDpzcGFjZT0icHJlc2VydmUiPjxnPjxwb2x5Z29uIGZpbGw9IiNGRkZGRkYiIHN0cm9rZT0iI0Q5REFEOSIgc3Ryb2tlLXdpZHRoPSIxLjE0MDYiIHN0cm9rZS1taXRlcmxpbWl0PSIxMCIgcG9pbnRzPSIyLjgsNC41NDkgMjYuODQ3LDE5LjkwMiAxNi45NjQsMjIuNzAxIDI0LjIzOSwzNy43NDkgMTguMjc4LDQyLjAxNyA5Ljc0MSwzMC43MjQgMS4xMzgsMzUuODA5ICIvPjxnPjxnPjxnPjxwYXRoIGZpbGw9IiMyMTI2MjciIGQ9Ik0yOS4xNzUsMjEuMTU1YzAuMDcxLTAuNjEzLTAuMTY1LTEuMjUzLTAuNjM1LTEuNTczTDIuMTY1LDAuMjU4Yy0wLjQyNC0wLjMyLTAuOTg4LTAuMzQ2LTEuNDM1LTAuMDUzQzAuMjgyLDAuNDk3LDAsMS4wMywwLDEuNjE3djM0LjE3MWMwLDAuNjEzLDAuMzA2LDEuMTQ2LDAuNzc2LDEuNDM5YzAuNDcxLDAuMjY3LDEuMDU5LDAuMjEzLDEuNDgyLTAuMTZsNy40ODItNi4zNDRsNi44NDcsMTIuMTU1YzAuMjU5LDAuNDgsMC43MjksMC43NDYsMS4yLDAuNzQ2YzAuMjM1LDAsMC40OTQtMC4wOCwwLjcwNi0wLjIxM2w2Ljk4OC00LjU4NWMwLjMyOS0wLjIxMywwLjU2NS0wLjU4NiwwLjY1OS0xLjAxM2MwLjA5NC0wLjQyNiwwLjAyNC0wLjg4LTAuMTg4LTEuMjI2bC02LjM3Ni0xMS4zODJsOC42MTEtMi43NDVDMjguNzA1LDIyLjI3NCwyOS4xMDUsMjEuNzY4LDI5LjE3NSwyMS4xNTV6IE0xNi45NjQsMjIuNzAxYy0wLjQyNCwwLjEzMy0wLjc3NiwwLjUwNi0wLjk0MSwwLjk2Yy0wLjE2NSwwLjQ4LTAuMTE4LDEuMDEzLDAuMTE4LDEuNDM5bDYuNTg4LDExLjc4MWwtNC41NDEsMi45ODVsLTYuODk0LTEyLjMxNWMtMC4yMTItMC4zNzMtMC41NDEtMC42NC0wLjk0MS0wLjcyYy0wLjA5NC0wLjAyNy0wLjE2NS0wLjAyNy0wLjI1OS0wLjAyN2MtMC4zMDYsMC0wLjU4OCwwLjEwNy0wLjg0NywwLjMyTDIuOCwzMi41OVY0LjU0OWwyMS41OTksMTUuODA2TDE2Ljk2NCwyMi43MDF6Ii8+PC9nPjwvZz48L2c+PC9nPjwvc3ZnPg=="},"moduleReadingGuide":{"color":"#ff0000","background":"#000000"},"snippets":{"copyright":"powered by <a href=https://designverign.de target=_blank rel=noopener title=designverign>designverign</a>","app.toggle.label":"Accessibility Tool ausklappen","menu.title":"Barrierefrei Hilfswerkzeuge","menu.button.move":"Icon verschieben","menu.button.page-structure":"Seiten-Struktur","menu.button.reset":"Zur\u00fccksetzen","menu.header.headers":"\u00dcberschriften","menu.header.landmarks":"Landmarks","menu.header.links":"Links","menu.position.left-top":"links oben","menu.position.left-center":"links zentriert","menu.position.left-bottom":"links unten","menu.position.right-top":"rechts oben","menu.position.right-center":"rechts mitte","menu.position.right-bottom":"rechts unten","menu.position.center-top":"mitte oben","menu.position.center-bottom":"mitte unten","module.button.bigger-text":"Gr\u00f6\u00dferer Text","module.button.bigger-text.0":"Gr\u00f6\u00dferer Text","module.button.bigger-text.1":"Gr\u00f6\u00dferer Text","module.button.bigger-text.2":"Gr\u00f6\u00dferer Text","module.button.bigger-text.3":"Gr\u00f6\u00dferer Text","module.button.cursor":"Mauszeiger","module.button.cursor.0":"Gro\u00dfer Mauszeiger","module.button.contrast":"Kontrast +","module.button.contrast.0":"Invertierte Farben","module.button.contrast.1":"Dunkler Kontrast","module.button.contrast.2":"Heller Kontrast","module.button.contrast.3":"Schwarz-Wei\u00df","module.button.highlight-links":"Links hervorheben","module.button.keyboard-nav":"Navigation per Tab-Taste","module.button.legible-fonts":"Schriftart","module.button.legible-fonts.0":"Lesbare Schriftart","module.button.legible-fonts.1":"Legasthenie freundlich","module.button.pause-animations":"Animationen pausieren","module.button.pause-animations.0":"Animationen abspielen","module.button.reading-guide":"Lese-F\u00fchrung","module.button.reading-guide.0":"Lese-F\u00fchrung","module.button.reading-guide.1":"Lese-F\u00fchrung","module.button.reading-guide.modal-title":"Hinweis","module.button.reading-guide.modal-text":"Tippen Sie kurz auf dem Bildschirm um die Lesef\u00fchrung auszurichten.","module.button.reading-guide.modal-button-text":"Verstanden","module.button.text-spacing":"Zeichen-Abstand","module.button.text-spacing.0":"Kleiner Abstand","module.button.text-spacing.1":"Moderater Abstand","module.button.text-spacing.2":"Gro\u00dfer Abstand","module.button.tooltips":"Zus\u00e4tzliche Beschreibung"},"reloadOnXHR":false};</script>
<link href="/custom/plugins/VerignDvAccessibility/Resources/public/css/dvaccess.min.css" media="all" rel="stylesheet" type="text/css" />
<link href="/custom/plugins/VerignDvAccessibility/Resources/public/css/shopwareaccess.css" media="all" rel="stylesheet" type="text/css" />
<script>
window.basketData = {
hasData: false,
data:[]
};
</script>
<div data-googleAnalytics="true" data-googleConversionID="965702328" data-googleConversionLabel="YIovCO7S_FYQuOW9zAM" data-googleConversionLanguage="de" data-googleTrackingID="UA-23529600-1" data-googleAnonymizeIp="1" data-googleOptOutCookie="" data-googleTrackingLibrary="ua" data-realAmount="" data-showCookieNote="1" data-cookieNoteMode="1" >
</div>
</head>
<body class="
is--ctl-detail is--act-index
is--sticky     " >
<input type="hidden" id="jsLoadMethod" value="async">
<div data-paypalUnifiedMetaDataContainer="true" data-paypalUnifiedRestoreOrderNumberUrl="https://www.b2b-brogsitter.de/widgets/PaypalUnifiedOrderNumber/restoreOrderNumber" class="is--hidden">
</div>
<div class='button--scroll-up is--hidden
btn--icon                                '
title='Go to top' style="background-color: #383841; bottom: 20px;
right: 25px;
">
<div class="button--text">Back to top</div>
<div class='icon--arrow-up'></div>
</div>
<div
data-live-shopping-listing="true" data-liveShoppingListingUpdateUrl="/widgets/LiveShopping/getLiveShoppingListingData" data-currencyFormat="0,00&nbsp;&euro;" >
<input type="hidden" name="sBitGlobalCurrency" value="EUR"/>
<input type="hidden" name="sGoogleBussinessVertical" value="retail"/>
<div class="page-wrap">
<noscript class="noscript-main">
<div class="alert animated zoomInDown is--warning">
<div class="alert--icon">
<i class="icon--element icon--warning"></i>
</div>
<div class="alert--content">
Um Brogsitter&#x20;B2B in vollem Umfang nutzen zu k&ouml;nnen, empfehlen wir Ihnen Javascript in Ihrem Browser zu aktiveren.
</div>
</div>
</noscript>
<header class="header-main">
<div class="top-bar bg-bar">
<div class="container block-group">
<span class="benefits show-mobile"><i class="icon icon--phone"></i>Mo-So von 7-21 Uhr: <a href="tel:+492225918111" style="color:#FFFFFF;">+49 (0)2225 / 918 111</a></span>
<span class="benefits"><i class="icon icon--paperplane"></i>Kauf auf Rechnung</span>
<span class="benefits"><i class="icon icon--truck"></i>Schnelle Lieferung</span>
</div>
</div>
<div class="container header--navigation">
<div class="logo-main block-group" role="banner">
<div class="logo--shop block">
<a class="logo--link" href="https://www.b2b-brogsitter.de/" title="Brogsitter Weinversand online - Startseite">
<img class="logo--img" src="/themes/Frontend/Btobbrogsitter/frontend/_public/src/img/brogsitter_b2b_logo.svg" alt="Brogsitter Weinversand online - Startseite" />
</a>
</div>
</div>
<nav class="shop--navigation block-group">
<ul class="navigation--list block-group" role="menubar">
<li class="navigation--entry entry--menu-left" role="menuitem">
<a class="entry--link entry--trigger btn is--icon-left" href="#offcanvas--left" data-offcanvas="true" data-offCanvasSelector=".sidebar-main" aria-label="Menü">
<i class="icon--menu"></i> Menü
</a>
</li>
<li class="navigation--entry entry--search" role="menuitem" data-search="true" aria-haspopup="true" data-minLength="3">
<a class="btn entry--link entry--trigger" href="#show-hide--search" title="Suche anzeigen / schließen" aria-label="Suche anzeigen / schließen">
<i class="icon--search"></i>
<span class="search--display">Suchen</span>
</a>
<form action="/search" method="get" class="main-search--form">
<input type="search" name="sSearch" aria-label="Suchbegriff..." class="main-search--field" autocomplete="off" autocapitalize="off" placeholder="Suchbegriff..." maxlength="30" />
<button type="submit" class="main-search--button" aria-label="Suchen">
<i class="icon--search"></i>
<span class="main-search--text">Suchen</span>
</button>
<div class="form--ajax-loader">&nbsp;</div>
</form>
<div class="main-search--results"></div>
</li>