CVE-2007-6544: SQL Injection

Published Dec 28, 2007

Updated

Multiple SQL injection vulnerabilities in RunCMS before 1.6.1 allow remote attackers to execute arbitrary SQL commands via the lid parameter to (1) brokenfile.php, (2) visit.php, or (3) ratefile.php in modules/mydownloads/; or (4) ratelink.php, (5) modlink.php, or (6) brokenlink.php in modules/mylinks/.

Affected Software

1 affected component

Runcms RunCMS=1.6

Remediation

Patch Available

http://www.securityfocus.com/bid/27019

Event History

Dec 28, 2007

CVE Published

12:46 AM

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-6544?

CVE-2007-6544 is considered a critical vulnerability due to its potential for remote SQL injection attacks.

How do I fix CVE-2007-6544?

To fix CVE-2007-6544, upgrade to RunCMS version 1.6.1 or later to ensure SQL injection protections are in place.

What are the consequences of exploiting CVE-2007-6544?

Exploiting CVE-2007-6544 can allow attackers to execute arbitrary SQL commands, potentially compromising the database and application integrity.

What versions of RunCMS are affected by CVE-2007-6544?

RunCMS versions before 1.6.1 are affected by CVE-2007-6544.

Which files are vulnerable in CVE-2007-6544?

CVE-2007-6544 affects multiple files, including brokenfile.php, visit.php, ratefile.php, ratelink.php, modlink.php, and brokenlink.php.