PT-2005-1890 · Php · Phpopenchat

Publicado 2005-03-24 · Atualizado 2018-10-19 · CVE-2005-0862

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHPOpenChat versions 3.0.1 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved via several parameters to different PHP files, including the phpbb root path parameter to files such as 'poc loginform.php' or 'phpbb/poc.php', the poc root path parameter to files like 'phpbb/poc.php', 'phpnuke/ENGLISH poc.php', 'phpnuke/poc.php', or 'yabbse/poc.php', and the sourcedir parameter to 'yabbse/poc.php'.

Recommendations For PHPOpenChat versions 3.0.1 and earlier, consider disabling the phpbb root path, poc root path, and sourcedir parameters in the affected PHP files until a patch is available. Restrict access to the vulnerable PHP files, such as 'poc loginform.php', 'phpbb/poc.php', 'phpnuke/ENGLISH poc.php', 'phpnuke/poc.php', and 'yabbse/poc.php', to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2005-0862

Produtos afetados

Phpopenchat

Referências · 15

• 🔥 https://exploit-db.com/exploits/25227 · Exploit
• 🔥 http://securitytracker.com/id?1013434 · Exploit
• 🔥 http://zone-h.org/advisories/read/id=7310 · Exploit
• 🔥 https://exploit-db.com/exploits/25229 · Exploit
• 🔥 https://exploit-db.com/exploits/25228 · Exploit
• http://secunia.com/advisories/14600 · Aviso do Fabricante
• http://osvdb.org/14807 · Nota
• http://securityfocus.com/archive/1/465237/100/0/threaded · Nota
• http://albanianhaxorz.org/advisory/phpopenchaten.txt · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19721 · Nota
• http://osvdb.org/14809 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0862 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-0862 · Nota de Segurança
• http://osvdb.org/14808 · Nota
• http://securityfocus.com/bid/12817 · Nota