Sql injection in RunCMS Sep 07 2006 05:09AM
Omid (omid hackers ir)
There are several sql injections in RunCMS 1.4.1 (and maybe before versions) :

The "uid" parameter in /class/sessions.class.php, is not checked correctly,
which can cause 2 sql injections .

Also, "timezone_offset" and "umode" parameters in /class/xoopsuser.php,
can make sql injections in 2 queries .

Fixpacks can be downloaded from RunCms official website :

The original advisory (in Persian) is located at :

- Omid

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus