CVE-2007-6548 Code injection in n/a
Remote authenticated administrators can inject arbitrary PHP code into cache files via multiple parameters, leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2007-6548?
CVE-2007-6548 is a high-severity code injection vulnerability in n/a, published on 28 Dec 2007. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Multiple direct static code injection vulnerabilities in RunCMS before 1.6.1 allow remote authenticated administrators to inject arbitrary PHP code via the (1) header and (2) footer parameters to modules/system/admin.php in a meta-generator action, (3) the disclaimer parameter to modules/system/admin.php in a disclaimer action, (4) the disclaimer parameter to modules/mydownloads/admin/index.php in a mydownloadsConfigAdmin action, (5) the disclaimer parameter to modules/newbb_plus/admin/forum_config.php, (6) the disclaimer parameter to modules/mylinks/admin/index.php in a myLinksConfigAdmin action, or (7) the intro parameter to modules/sections/admin/index.php in a secconfig action, which inject PHP sequences into (a) sections/cache/intro.php, (b) mylinks/cache/disclaimer.php, (c) mydownloads/cache/disclaimer.php, (d) newbb_plus/cache/disclaimer.php, (e) system/cache/disclaimer.php, (f) system/cache/footer.php, (g) system/cache/header.php, or (h) system/cache/maintenance.php in modules/.
Weakness: CWE-94
Which versions are affected by CVE-2007-6548?
It affects 1 product.
Products include Runcms Runcms.
How do I fix CVE-2007-6548?
No fix has been published for CVE-2007-6548 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2007-6548 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2007-6548 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-465v-95qw-94v6.