CVE-2009-0963

PHPRunner 4.2 is affected by multiple SQL injection vulnerabilities in the SearchField parameter affecting UserView_list.php, orders_list.php, users_list.php, and Administrator_list.php. The root cause is improper validation/handling of input in the SearchField parameter, enabling remote attacker...

CVE-2009-0964

PHPRunner 4.2 (and possibly earlier) stores passwords in cleartext in the database, enabling privilege escalation. The CVE description notes that this can be exploited in combination with a separate SQL injection vulnerability to obtain passwords remotely without authentication. Connected sources...

CVE-2006-5956

XLineSoft PHPRunner 3.1 stores the (1) database server name, (2) database names, (3) usernames, and (4) passwords in plaintext in %WINDIR%\PHPRunner.ini. This plaintext credential exposure allows local users to obtain sensitive information by reading the file. Root cause is insecure storage of cr...