PT-2006-5452 · Runcms · Runcms

Omid · Publicado 2006-09-09 · Atualizado 2018-10-17 · CVE-2006-4667

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions RunCMS version 1.4.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the uid parameter in class/sessions.class.php, and the timezone offset and umode parameters in class/xoopsuser.php.

Recommendations For RunCMS version 1.4.1, consider restricting access to the class/sessions.class.php and class/xoopsuser.php files until a patch is available. Avoid using the uid, timezone offset, and umode parameters in the affected files to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-4667

Produtos afetados

Runcms

Referências · 12

• http://runcms.org/modules/mydownloads/viewcat.php?cid=5 · Correção
• http://osvdb.org/28617 · Nota
• http://hackers.ir/advisories/runcms.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4667 · Nota
• http://securityfocus.com/bid/19913 · Nota
• http://secunia.com/advisories/21814 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-4667 · Nota de Segurança
• http://vupen.com/english/advisories/2006/3522 · Nota
• http://securityreason.com/securityalert/1532 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28806 · Nota
• http://securityfocus.com/archive/1/445524/100/0/threaded · Nota
• http://osvdb.org/28616 · Nota