RunCMS < 1.3a3 Arbitrary File Upload

High Nessus Network Monitor Plugin ID 3423


The remote host is vulnerable to a file upload flaw.


The remote host is running RunCMS, a web-based messaging system. This version of RunCMS is vulnerable to a remote file upload flaw. Specifically, an attacker can create a malicious .php3 or .php5 script and upload it to the RunCMS server. The attacker can then invoke the script, causing arbitrary code to be run on the RunCMS system.


Upgrade to version 1.3a3 or higher, when available.

See Also

Plugin Details

Severity: High

ID: 3423

Family: CGI

Published: 2006/02/10

Modified: 2018/07/11

Dependencies: 1442

Risk Information

Risk Factor: High


Base Score: 7.6

Temporal Score: 6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C


Base Score: 8.1

Temporal Score: 7.2


Temporal Vector: CVSS3#E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:runcms:runcms

Reference Information

CVE: CVE-2006-0659, CVE-2006-0721, CVE-2006-1793

BID: 16652, 16578