PT-2006-1483 · Sleeperchat · Sleeperchat

Publicado 2006-01-25 · Atualizado 2017-07-20 · CVE-2006-0416

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SleeperChat versions 0.3f and earlier

Description The issue allows remote attackers to bypass authentication and create new entries. This is achieved via the txt parameter to API endpoints such as "chat no.php" and "chat if.php".

Recommendations For SleeperChat versions 0.3f and earlier, consider restricting access to the "chat no.php" and "chat if.php" API endpoints to minimize the risk of exploitation. Avoid using the txt parameter in these endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2006-0416

Produtos afetados

Sleeperchat

Referências · 3

• 🔥 http://securitytracker.com/id?1015525 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24357 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0416 · Nota de Segurança