CVE-2009-3814

Static code injection vulnerability in RunCMS 2M1 allows remote authenticated administrators to execute arbitrary PHP code via the "Filter/Banning" feature, as demonstrated by modifying modules/system/cache/bademails.php using the "Prohibited: Emails" action, and other unspecified filters...

CVE-2009-3815

CVE-2009-3815 affects RunCMS 2M1. When run with certain error_reporting levels, remote attackers can access sensitive information via the op[] parameter to modules/contact/index.php or the uid[] parameter to userinfo.php, causing an error message to leak the installation path through preg_match. ...

RunCMS 2m1 - store() SQL Injection

RunCMS 2m1 - store SQL Injection postid.", pid=".$this-pid.", topicid=".$this-topicid.", forumid=".$this-forumid.", posttime=$datetime, uid=".$this-uid.", posterip='".$this-posterip."', subject='".$subject."', posttext='".$posttext."', allowhtml=".intval$this-allowhtml.",...

RunCms v.2M1 /modules/forum/post.php - 'forum' remote semi-blind SQL Injection Exploit

?php / RunCms v.2M1 /modules/forum/post.php - 'forum' remote semi-blind SQL Injection Exploit by Nine:Situations:Group::bookoo site: http://retrogod.altervista.org/ software site: http://www.runcms.org/ vulnerable code in /modules/forum/post.php near lines 16-34 : ... if empty$POST'forum'...

RunCMS 2m1 store() SQL injection

Exploit for unknown platform in category web applications ================================ RunCMS 2m1 store SQL injection ================================ postid.", pid=".$this-pid.", topicid=".$this-topicid.", forumid=".$this-forumid.", posttime=$datetime, uid=".$this-uid.",...

RunCMS 2m1 - 'store()' SQL Injection

postid.", pid=".$this-pid.", topicid=".$this-topicid.", forumid=".$this-forumid.", posttime=$datetime, uid=".$this-uid.", posterip='".$this-posterip."', subject='".$subject."', posttext='".$posttext."', allowhtml=".intval$this-allowhtml.", allowsmileys=".intval$this-allowsmileys.",...

RunCMS 2ma post.php SQL injection

Exploit for unknown platform in category web applications ================================= RunCMS 2ma post.php SQL injection ================================= query$sql redirectheader"index.php", 2, MDCANTGETFORUM; exit; ... 'forum' variable is taken from $POST array and inserted in a sql query...

RunCMS 2M1 SQL Injection

postid.", pid=".$this-pid.", topicid=".$this-topicid.", forumid=".$this-forumid.", posttime=$datetime, uid=".$this-uid.", posterip='".$this-posterip."', subject='".$subject."', posttext='".$posttext."', allowhtml=".intval$this-allowhtml.", allowsmileys=".intval$this-allowsmileys.",...

RunCMS 2m1 store() SQL injection

No description provided by source. ?php / RunCms v.2M1 store - 'pid' remote SQL Injection Exploit by Nine:Situations:Group::bookoo site: http://retrogod.altervista.org/ software site: http://www.runcms.org/ Function store in /modules/forum/class/class.forumposts.php is vulnerable, see lines...

RunCMS 2ma - post.php SQL Injection

RunCMS 2ma - post.php SQL Injection query$sql redirectheader"index.php", 2, MDCANTGETFORUM; exit; ... 'forum' variable is taken from $POST array and inserted in a sql query without prior santization and without being surrounded by quotes. Then you can subsequently manipulate this query in...

RunCMS 2ma - 'post.php' SQL Injection

query$sql redirectheader"index.php", 2, MDCANTGETFORUM; exit; ... 'forum' variable is taken from $POST array and inserted in a sql query without prior santization and without being surrounded by quotes. Then you can subsequently manipulate this query in /modules/forum/class/class.permissions.php ...

RunCMS - 'forum' SQL Injection

source: https://www.securityfocus.com/bid/36816/info RunCMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, ...

RunCMS 2ma post.php SQL injection

No description provided by source. ?php / RunCms v.2M1 /modules/forum/post.php - 'forum' remote semi-blind SQL Injection Exploit by Nine:Situations:Group::bookoo site: http://retrogod.altervista.org/ software site: http://www.runcms.org/ vulnerable code in /modules/forum/post.php near lines 16-34...

Cross site scripting

Cross-site scripting XSS vulnerability in system/admin.php in RunCMS 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the ranktitle parameter in a RankForumAdd action...

CVE-2008-7222

Cross-site scripting XSS vulnerability in system/admin.php in RunCMS 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the ranktitle parameter in a RankForumAdd action...

CVE-2008-7221

Cross-site request forgery CSRF vulnerability in RunCMS 1.6.1 allows remote attackers to hijack the authentication of administrators for requests that 1 add new administrators or 2 modify user profiles via a crafted request to system/admin.php...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in RunCMS 1.6.1 allows remote attackers to hijack the authentication of administrators for requests that 1 add new administrators or 2 modify user profiles via a crafted request to system/admin.php...

CVE-2008-7221

RunCMS 1.6.1 is affected by a CSRF vulnerability that lets remote attackers hijack administrator sessions by sending crafted requests to system/admin.php, enabling (1) addition of new administrators or (2) modification of user profiles. The vulnerability is triggered through authenticated admin a...

CVE-2008-7222

CVE-2008-7222 describes a cross-site scripting (XSS) vulnerability in RunCMS 1.6.1, specifically in the system/admin.php module. The issue arises when handling the RankForumAdd action, where an attacker can inject arbitrary web script or HTML via the rank_title parameter. Documents consistently i...

CVE-2008-7222

Cross-site scripting XSS vulnerability in system/admin.php in RunCMS 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the ranktitle parameter in a RankForumAdd action...