PT-2006-5452 · Runcms · Runcms

Omid · Published 2006-09-09 · Updated 2018-10-17 · CVE-2006-4667

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions RunCMS version 1.4.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the uid parameter in class/sessions.class.php, and the timezone offset and umode parameters in class/xoopsuser.php.

Recommendations For RunCMS version 1.4.1, consider restricting access to the class/sessions.class.php and class/xoopsuser.php files until a patch is available. Avoid using the uid, timezone offset, and umode parameters in the affected files to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-4667

Affected Products

Runcms

References · 12

• http://runcms.org/modules/mydownloads/viewcat.php?cid=5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-4667 · Security Note
• http://osvdb.org/28617 · Note
• http://hackers.ir/advisories/runcms.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4667 · Note
• http://securityfocus.com/bid/19913 · Note
• http://secunia.com/advisories/21814 · Note
• http://vupen.com/english/advisories/2006/3522 · Note
• http://securityreason.com/securityalert/1532 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28806 · Note
• http://securityfocus.com/archive/1/445524/100/0/threaded · Note
• http://osvdb.org/28616 · Note