CVE-2007-6548: Code Injection
Multiple direct static code injection vulnerabilities in RunCMS before 1.6.1 allow remote authenticated administrators to inject arbitrary PHP code via the (1) header and (2) footer parameters to modules/system/admin.php in a meta-generator action, (3) the disclaimer parameter to modules/system/admin.php in a disclaimer action, (4) the disclaimer parameter to modules/mydownloads/admin/index.php in a mydownloadsConfigAdmin action, (5) the disclaimer parameter to modules/newbbplus/admin/forumconfig.php, (6) the disclaimer parameter to modules/mylinks/admin/index.php in a myLinksConfigAdmin action, or (7) the intro parameter to modules/sections/admin/index.php in a secconfig action, which inject PHP sequences into (a) sections/cache/intro.php, (b) mylinks/cache/disclaimer.php, (c) mydownloads/cache/disclaimer.php, (d) newbbplus/cache/disclaimer.php, (e) system/cache/disclaimer.php, (f) system/cache/footer.php, (g) system/cache/header.php, or (h) system/cache/maintenance.php in modules/.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-6548?
CVE-2007-6548 is considered a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2007-6548?
To fix CVE-2007-6548, upgrade RunCMS to version 1.6.1 or later, which addresses the static code injection vulnerabilities.
What are the affected versions in CVE-2007-6548?
CVE-2007-6548 affects all versions of RunCMS prior to 1.6.1.
Who can exploit CVE-2007-6548?
CVE-2007-6548 can be exploited by remote authenticated administrators with access to the affected modules.
What types of vulnerabilities are present in CVE-2007-6548?
CVE-2007-6548 contains multiple direct static code injection vulnerabilities that could allow arbitrary PHP code execution.