James Bercegay has reported some vulnerabilities in RunCMS, which can be exploited by malicious people to conduct SQL injection attacks.

1) Incorrect use of the EXTR_OVERWRITE argument in the "extract()" function in /includes/common.php allows variables passed via the POST method to overwrite arbitrary variables. This can be exploited to modify certain SQL statements used in the search engine by overwriting the "addquery" and "subquery" variables.

2) Input passed to the "forum" parameter in newbb_plus/newtopic.php, newbb_plus/edit.php, and newbb_plus/reply.php, and the "msg_id" parameter in messages/print.php is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerabilities have been reported in versions 1.2 and prior.

Solution
The vulnerabilities were reportedly silently patched in mid July.

Provided and/or discovered by
James Bercegay, GulfTech Security Research Team.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.gulftech.org/?node=research&article_id=00094-08192005

Deep Links
Links available to Secunia VIM customers