PT-2007-6909 · X7 · X7 Chat

Publicado 2007-11-15 · Atualizado 2008-11-15 · CVE-2007-5982

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions X7 Chat versions 2.0.4 through 2.0.5

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The affected API endpoints include "sources/frame.php", "help/index.php", and "upgradev1.php". The vulnerable parameters are the room parameter, the theme c parameter, and the INSTALL X7CHATVERSION parameter.

Recommendations For X7 Chat versions 2.0.4 and 2.0.5, consider disabling access to the "sources/frame.php", "help/index.php", and "upgradev1.php" endpoints until a patch is available. Restrict the use of the room, theme c, and INSTALL X7CHATVERSION parameters in these endpoints to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-5982

Produtos afetados

X7 Chat

Referências · 9

• 🔥 http://securityfocus.com/bid/26417 · Exploit
• 🔥 https://exploit-db.com/exploits/30757 · Exploit
• 🔥 https://exploit-db.com/exploits/30758 · Exploit
• http://packetstorm.linuxsecurity.com/0711-exploits/x7-xss.txt · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5982 · Nota de Segurança
• http://osvdb.org/38746 · Nota
• http://secunia.com/advisories/27677 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5982 · Nota
• http://osvdb.org/38745 · Nota