EDB-4790
functionalRunCMS 1.6 - Multiple Vulnerabilities
view exploit source exploit_dbverifiedtype webappsauthor DSecRGpublished 2007-12-25catalog exploit_db
01
exploited CVEs (4)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2007-6545US | medium4.3 | Exploit | ||
Multiple cross-site scripting (XSS) vulnerabilities in RunCMS before 1.6.1 allow remote attackers to inject arbitrary web script or HTML via (1) the subject parameter to modules/ne… | ||||
| CVE-2007-6546US | medium6.4 | Exploit | ||
RunCMS before 1.6.1 uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a modified id. | ||||
| CVE-2007-6547US | medium6.8 | Exploit | ||
RunCMS before 1.6.1 does not require entry of the old password during a password change, which allows context-dependent attackers to change passwords upon obtaining temporary acces… | ||||
| CVE-2007-6548US | high7.5 | Exploit | ||
Multiple direct static code injection vulnerabilities in RunCMS before 1.6.1 allow remote authenticated administrators to inject arbitrary PHP code via the (1) header and (2) foote… | ||||
scry
Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.
Free scan