RunCMS Newbb_plus Module Disclaimer.PHP Remote Script Execution Vulnerability

Bugtraq ID:	26571
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 24 2007 12:00AM
Updated:	Nov 26 2007 09:33PM
Credit:	AmnPardaz is credited with the discovery of this vulnerability.
Vulnerable:	RunCMS RunCMS 1.5.3 RunCMS RunCMS 1.5.2 Build 20070504 RunCMS RunCMS 1.5.2 RunCMS RunCMS 1.6
Not Vulnerable:

RunCMS Newbb_plus Module Disclaimer.PHP Remote Script Execution Vulnerability

RunCMS is prone to a remote script-execution vulnerability due to a design error in the module-authorization mechanism.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects RunCMS 1.6, 1.5.3, and 1.5.2; other versions may also be vulnerable.

RunCMS Newbb_plus Module Disclaimer.PHP Remote Script Execution Vulnerability

An attacker can exploit this issue via a browser.

RunCMS Newbb_plus Module Disclaimer.PHP Remote Script Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

RunCMS Newbb_plus Module Disclaimer.PHP Remote Script Execution Vulnerability

References:

• RunCms Homepage (RunCms)