CVE-2007-6546 RunCMS before 1.6.1 uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a modified id.
MediumCVSS 6.4
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
RunCMS before 1.6.1 uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a modified id.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| runcms | <= 1.6 | No fix listed |
References
- 41245 vdb-entry
- 3493 third-party-advisory
- www.runcms.org
- 20071225 Multiple vulnerabilities in RUNCMS 1.6 by DSecRG mailing-list
- 27019 vdb-entry
- 4790 exploit