----------------------------------------------------------------------

A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI
has been released. The new version includes many new and advanced
features, which makes it even easier to stay patched.

Download and test it today:
https://psi.secunia.com/

Read more about this new version:
https://psi.secunia.com/?page=changelog

----------------------------------------------------------------------

TITLE:
RunCms Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA28204

VERIFY ADVISORY:
http://secunia.com/advisories/28204/

CRITICAL:
Moderately critical

IMPACT:
Unknown, Cross Site Scripting, Manipulation of data, System access

WHERE:
>From remote

SOFTWARE:
RunCms 1.x
http://secunia.com/product/4808/

DESCRIPTION:
Some vulnerabilities have been reported in RunCms, two of which have
unknown impact and others, which can be exploited by malicious users
to conduct script insertion attacks and to compromise a vulnerable
system, and by malicious people to conduct cross-site scripting
attacks and SQL injection attacks.

1) Input passed to the "lid" parameter in
modules/mydownloads/brokenfile.php, modules/mydownloads/ratefile.php,
and modules/mydownloads/visit.php is not properly sanitised before
being used in SQL queries. This can be exploited to manipulate SQL
queries by injecting arbitrary SQL code.

2) Input passed in the URL to modules/news/index.php is not properly
sanitised before being returned to the user. This can be exploited to
execute arbitrary HTML and script code in a user's browser session in
context of an affected site.

3) Input passed as uploaded avatar pictures to edituser.php is not
properly sanitised before being stored. This can be exploited to
insert arbitrary HTML and script code, which is executed in a user's
browser session in context of an affected site when the malicious
data is viewed.

Successful exploitation of this vulnerability requires valid user
credentials.

4) Input passed in various parameters to modules/system/admin.php,
modules/mydownloads/admin/index.php,
modules/newbb_plus/admin/forum_config.php,
modules/mylinks/admin/index.php, and modules/sections/admin/index.php
is not properly sanitised before being stored. This can be exploited
to execute arbitrary PHP code.

Successful exploitation of this vulnerability requires valid
administrator credentials.

5) A vulnerability is caused due to an unknown error in the pagetype
functionality. No further information is currently available.

6) A vulnerability is caused due to an unknown error in
XoopsGroup::isAccessible(). No further information is currently
available.

The vulnerabilities are reported in version 1.6. Prior versions may
also be affected.

SOLUTION:
Update to version 1.6.1.

Use another product.

PROVIDED AND/OR DISCOVERED BY:
1-4) Alexandr Polyakov and Stas Svistunovich
5) Zormax
6) Reported by the vendor.

ORIGINAL ADVISORY:
http://www.runcms.org/modules/mydownloads/singlefile_lid_131.html
http://milw0rm.com/exploits/4790
http://milw0rm.com/exploits/4787

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------