PT-2007-2788 · Flatchat · Flatchat

Dj7Xpl · Publicado 2007-03-10 · Atualizado 2017-10-11 · CVE-2007-1394

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Flat Chat version 2.0

Description A direct static code injection issue exists, allowing remote attackers to execute arbitrary PHP code. This is achieved via the Chat Name field, which is inserted into online.txt and included by users.php.

Recommendations For Flat Chat version 2.0, consider restricting access to the startsession.php file until a patch is available. As a temporary workaround, avoid using the Chat Name field in the affected startsession.php file to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2007-1394

Produtos afetados

Flatchat

Referências · 7

• 🔥 http://secunia.com/advisories/24433 · Exploit
• 🔥 http://securityfocus.com/bid/22865 · Exploit
• 🔥 https://exploit-db.com/exploits/3428 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1394 · Nota de Segurança
• http://vupen.com/english/advisories/2007/0871 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32882 · Nota
• http://osvdb.org/33890 · Nota