Total vulnerabilities in the database
includes/common.php in RunCMS 1.2 and earlier calls the extract function with EXTR_OVERWRITE on HTTP POST variables, which allows remote attackers to overwrite arbitrary variables, possibly allowing execution of arbitrary code.
| Software | From | Fixed in |
|---|---|---|
| runcms / runcms | 1.1a | 1.1a.x |
| runcms / runcms | 1.2 | 1.2.x |
| runcms / runcms | 1.1 | 1.1.x |