CVE-2007-6544

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-12-28 · updated 2026-06-16
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in RunCMS before 1.6.1 allow remote attackers to execute arbitrary SQL commands via the lid parameter to (1) brokenfile.php, (2) visit.php, or (3) ratefile.php in modules/mydownloads/; or (4) ratelink.php, (5) modlink.php, or (6) brokenlink.php in modules/mylinks/.

Affected products

Runcms: 1.6

References

http://osvdb.org/41235
http://osvdb.org/41236
http://osvdb.org/41237
http://osvdb.org/41238
http://osvdb.org/41239
http://osvdb.org/41240
http://securityreason.com/securityalert/3493
http://www.runcms.org/modules/mydownloads/singlefile.php?lid=131
http://www.securityfocus.com/archive/1/485512/100/0/threaded
http://www.securityfocus.com/bid/27019
https://exchange.xforce.ibmcloud.com/vulnerabilities/39289
https://www.exploit-db.com/exploits/4787

Get alerted when CVE-2007-6544 or the next vulnerability affects your stack