Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: CMS / Portals :: b06-4633.htm

RunCMS SQL Injection vuln



Sql injection in RunCMS
Sql injection in RunCMS



Hi,
There are several sql injections in RunCMS 1.4.1 (and maybe before versions) :

The "uid" parameter in /class/sessions.class.php, is not checked correctly,
which can cause 2 sql injections .

Also, "timezone_offset" and "umode" parameters in /class/xoopsuser.php,
can make sql injections in 2 queries .

Fixpacks can be downloaded from RunCms official website :
http://www.runcms.org/modules/mydownloads/viewcat.php?cid=5 

The original advisory (in Persian) is located at :
http://www.hackers.ir/advisories/runcms.html 


- Omid


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH