PT-2007-3491 · Chatness · Chatness

Gammarays · Publicado 2007-04-19 · Atualizado 2018-10-16 · CVE-2007-2149

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Chatness versions 2.5.3 and earlier

Description The issue allows local users to gain privileges and remote attackers to obtain credentials. This is due to the storage of usernames and unencrypted passwords in files such as classes/vars.php and classes/varstuff.php, with recommended permissions of 0666 or 0777, making the files accessible. Remote attackers can exploit this by making a direct request for admin/options.php.

Recommendations For Chatness versions 2.5.3 and earlier, consider changing the permissions of the files classes/vars.php and classes/varstuff.php to more secure settings to prevent unauthorized access. Additionally, restrict access to the admin/options.php endpoint to minimize the risk of exploitation. As a temporary workaround, consider encrypting the stored passwords until a more permanent fix can be applied.

Exploit

Correção

Identificadores relacionados

CVE-2007-2149

Produtos afetados

Chatness

Referências · 6

• 🔥 https://exploit-db.com/exploits/3725 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2149 · Nota de Segurança
• http://securityreason.com/securityalert/2595 · Nota
• http://vupen.com/english/advisories/2007/1386 · Nota
• http://securityfocus.com/archive/1/465547/100/0/threaded · Nota
• http://secunia.com/advisories/24873 · Aviso do Fabricante