CVE-2007-6544

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 4.3%

from disclosure to weapon0 days

Published on NVDDec 28

1st PoCDec 26

exploitation probability

4.3%top 10% of all CVEs

observed exploitation

nono source reports it

3 public exploit(s)

Multiple SQL injection vulnerabilities in RunCMS before 1.6.1 allow remote attackers to execute arbitrary SQL commands via the lid parameter to (1) brokenfile.php, (2) visit.php, or (3) ratefile.php in modules/mydownloads/; or (4) ratelink.php, (5) modlink.php, or (6) brokenlink.php in modules/mylinks/.

Affected products

n/a · n/a

public PoCs found — 3✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/4792 cve_reference✓ VexDay Proofwww.exploit-db.com/exploits/4787 cve_referencewww.exploit-db.com/exploits/4790unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://osvdb.org/41235 http://osvdb.org/41236 http://osvdb.org/41237 http://osvdb.org/41238 http://osvdb.org/41239 http://osvdb.org/41240 http://securityreason.com/securityalert/3493 https://exchange.xforce.ibmcloud.com/vulnerabilities/39289 https://www.exploit-db.com/exploits/4787 https://www.exploit-db.com/exploits/4790 http://www.runcms.org/modules/mydownloads/singlefile.php?lid=131 http://www.securityfocus.com/archive/1/485512/100/0/threaded