PT-2004-3607 · Phpmychat · Phpmychat

Publicado 2004-12-31 · Atualizado 2009-04-03 · CVE-2004-2717

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHPMyChat version 0.14.5

Description The issue concerns directory traversal vulnerabilities in the admin.php3 file of PHPMyChat. These vulnerabilities allow remote attackers with administrative privileges to read arbitrary files. This is achieved by including a .. (dot dot) in the sheet and What parameters.

Recommendations For PHPMyChat version 0.14.5, consider restricting access to the admin.php3 file until a patch is available, and avoid using the sheet and What parameters with untrusted input.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2004-2717

Produtos afetados

Phpmychat

Referências · 7

• 🔥 https://exploit-db.com/exploits/24217 · Exploit
• 🔥 http://securityfocus.com/bid/10556 · Exploit
• http://archives.neohapsis.com/archives/bugtraq/2004-06/0252.html · Nota
• http://secunia.com/advisories/11894 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-2717 · Nota de Segurança
• http://osvdb.org/7150 · Nota
• http://securitytracker.com/id?1010515 · Nota