RCE in Runcms

CVE-2009-3814

Static code injection vulnerability in RunCMS 2M1 allows remote authenticated administrators to execute arbitrary PHP code via the "Filter/Banning" feature, as demonstrated by modifying modules/system/cache/bademails.php using the "Prohibited: Emails" action, and other unspecified filters.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.011 (61.3th percentile) — read the EPSS interpretation.

Affected products

  • Runcms — versions 2m1
  • N/a — versions n/a

Weakness classification (CWE)

References