| Package | Affected versions | Patched versions |
|---|---|---|
| runcms | = 1.1= 1.1a= 1.2 |
includes/common.php in RunCMS 1.2 and earlier calls the extract function with EXTR_OVERWRITE on HTTP POST variables, which allows remote attackers to overwrite arbitrary variables, possibly allowing execution of arbitrary code.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free