CVE-2007-2538
CVE-2007-2538 is a high-severity vulnerability in Runcms with a CVSS 2.0 base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: High (CVSS 2.0 base score 7.5)
- EPSS exploit prediction: 5% (91st percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Runcms
- Published:
- Last modified:
Description
SQL injection vulnerability in class/debug/debug_show.php in RunCms 1.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the executed_queries array parameter.
Frequently asked questions
- What is CVE-2007-2538?
- SQL injection vulnerability in class/debug/debug_show.php in RunCms 1.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the executed_queries array parameter.
- How severe is CVE-2007-2538?
- CVE-2007-2538 has a CVSS 2.0 base score of 7.5, rated high severity.
- Is CVE-2007-2538 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 5% (91st percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2007-2538?
- CVE-2007-2538 affects Runcms. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2007-2538?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2007-2538 published?
- CVE-2007-2538 was published on 2007-05-09 and last updated on 2026-06-16.
References
- http://osvdb.org/35782
- http://retrogod.altervista.org/runcms_152_sql.html
- http://secunia.com/advisories/25154
- http://securityreason.com/securityalert/2671
- http://www.runcms.org/modules/news/
- http://www.securityfocus.com/archive/1/467665/100/0/threaded
- http://www.securityfocus.com/bid/23819
- http://www.vupen.com/english/advisories/2007/1669
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34075
- https://www.exploit-db.com/exploits/3850
Affected products (1)
- cpe:2.3:a:runcms:runcms:*:*:*:*:*:*:*:*
More vulnerabilities in Runcms
- CVE-2007-5535 — Critical (CVSS 10.0): Unspecified vulnerability in newbb_plus in RunCms 1.5.2 has unknown impact and attack vectors.
- CVE-2007-2539 — High (CVSS 7.8): The show_files function in RunCms 1.5.2 and earlier allows remote attackers to obtain sensitive information (file…
- CVE-2006-1793 — High (CVSS 7.6): Directory traversal vulnerability in runCMS 1.2 and earlier allows remote attackers to read arbitrary files via the…
- CVE-2008-3354 — High (CVSS 7.5): Multiple PHP remote file inclusion vulnerabilities in the Newbb Plus (newbb_plus) module 0.93 in RunCMS 1.6.1 allow…
- CVE-2008-1551 — High (CVSS 7.5): SQL injection vulnerability in viewcat.php in the Photo 3.02 module for RunCMS allows remote attackers to execute…
- CVE-2008-0224 — High (CVSS 7.5): SQL injection vulnerability in index.php in the Newbb_plus 0.92 and earlier module in RunCMS 1.6.1 allows remote…