CVE-2006-0659

Severity CVSS v4.0:
Pending analysis
Type:
CWE-94 Code Injection
Publication date:
13/02/2006
Last modified:
03/04/2025

Description

Multiple PHP remote file include vulnerabilities in RunCMS 1.2 and earlier, with register_globals and allow_url_fopen enabled, allow remote attackers to execute arbitrary code via the bbPath[path] parameter in (1) class.forumposts.php and (2) forumpollrenderer.php.

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:runcms:runcms:*:*:*:*:*:*:*:* 1.2 (including)
cpe:2.3:a:runcms:runcms:1.1:*:*:*:*:*:*:*
cpe:2.3:a:runcms:runcms:1.1a:*:*:*:*:*:*:*