SQL Injection in Runcms

CVE-2009-3804

Multiple SQL injection vulnerabilities in modules/forum/post.php in RunCMS 2M1 allow remote authenticated users to execute arbitrary SQL commands via (1) the pid parameter, which is not properly handled by the store function in modules/forum/class/class.forumposts.php, or (2) the topic_id parameter.

Vulnerability class: SQL Injection

EPSS: 0.008 (53.1th percentile) — read the EPSS interpretation.

Affected products

  • Runcms — versions 2m1
  • N/a — versions n/a

Weakness classification (CWE)

References