CVE-2007-6544

Multiple SQL injection vulnerabilities in RunCMS before 1.6.1 allow remote attackers to execute arbitrary SQL commands via the lid parameter to 1 brokenfile.php, 2 visit.php, or 3 ratefile.php in modules/mydownloads/; or 4 ratelink.php, 5 modlink.php, or 6 brokenlink.php in modules/mylinks/...

Session fixation

RunCMS before 1.6.1 does not require entry of the old password during a password change, which allows context-dependent attackers to change passwords upon obtaining temporary access to a session...

CVE-2007-6546

RunCMS before 1.6.1 uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a modified id...

CVE-2007-6549

Unspecified vulnerability in RunCMS before 1.6.1 has unknown impact and attack vectors, related to "pagetype using."...

Design/Logic Flaw

RunCMS before 1.6.1 uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a modified id...

runcms-multi.txt

Digital Security Research Group Advisory Application: RunCMS Versions Affected: RunCMS 1.6 Vendor URL: http://www.runcms.org Bugs: SQL Injections, XSS, PHP Include, Predictable session id, etc. Exploits: Aviable Reported: 14.12.2007 Vendor response: 15.12.2007 Date of Public Advisory: 25.12.2007...

CVE-2007-6549

Unspecified vulnerability in RunCMS before 1.6.1 has unknown impact and attack vectors, related to "pagetype using."...

CVE-2007-6545

CVE-2007-6545 concerns RunCMS pre-1.6.1, with multiple XSS vectors: (1) subject parameter in modules/news/submit.php, (2) PATH_INFO to modules/news/index.php (potentially related to XoopsPageNav), and (3) an avatar image to edituser.php. The connected documents do not provide exploitation details...

CVE-2007-6548

Multiple direct static code injection vulnerabilities in RunCMS before 1.6.1 allow remote authenticated administrators to inject arbitrary PHP code via the 1 header and 2 footer parameters to modules/system/admin.php in a meta-generator action, 3 the disclaimer parameter to modules/system/admin.p...

CVE-2007-6549

Technical details (affected products, components, versions, impact, or fix) are not publicly available in the provided documents; monitor for updates.

CVE-2007-6547

RunCMS before 1.6.1 does not require entry of the old password during a password change, which allows context-dependent attackers to change passwords upon obtaining temporary access to a session...

runcms-sqlids.txt

// / RUNCMS 1.6 BLIND SQL Injection Exploit + IDS evasion / // / exploit get hash of admin password / / / / Exploit is invisible for / / RUNCMS sql injection detecting mechanism / // // / tested on RUNCMS english version 1.6 / // // / Date of Public EXPLOIT: December 25, 2007 / / Written by:...

CVE-2007-6546

RunCMS before 1.6.1 uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a modified id...

CVE-2007-6547

CVE-2007-6547 affects RunCMS prior to 1.6.1. The issue arises because the password-change flow does not require the entry of the old password, enabling a context-dependent attacker with temporary session access to change the password. The CVSSv2 base score listed is 6.8 (Medium) with network atta...

runcms-sql.txt

// / RUNCMS 1.6 BLIND SQL Injection Exploit get Admin Cookie / // / exploit get admin cookie that can be used / / to login by pasting it into browser Opera / / and then get access to Admin session / / and change Admins password / / / // // / tested on RUNCMS english version 1.6 / // // / Date of...

CVE-2007-6546

CVE-2007-6546 affects RunCMS prior to 1.6.1. The issue is a predictable session ID that enables remote attackers to hijack a user session by modifying the session identifier. The available data states the vulnerability could allow such session hijacking, with a base severity of medium (CVSSv2 6.4...

CVE-2007-6544

Multiple SQL injection vulnerabilities in RunCMS before 1.6.1 allow remote attackers to execute arbitrary SQL commands via the lid parameter to 1 brokenfile.php, 2 visit.php, or 3 ratefile.php in modules/mydownloads/; or 4 ratelink.php, 5 modlink.php, or 6 brokenlink.php in modules/mylinks/...

CVE-2007-6544

CVE-2007-6544 affects RunCMS

CVE-2007-6548

CVE-2007-6548 affects RunCMS up to version 1.6.1 and involves multiple direct static code injection vulnerabilities. Remote authenticated administrators can inject arbitrary PHP code via specific parameters in admin interfaces: header/footer (modules/system/admin.php), disclaimer (modules/system/...

CVE-2007-6545

Multiple cross-site scripting XSS vulnerabilities in RunCMS before 1.6.1 allow remote attackers to inject arbitrary web script or HTML via 1 the subject parameter to modules/news/submit.php; 2 the PATHINFO to modules/news/index.php, possibly related to the XoopsPageNav class; or 3 an avatar image...