PT-2014-6388 · Pro Chat Rooms · Pro Chat Rooms Text Chat Rooms

Mike Manzotti · Publicado 2014-10-20 · Atualizado 2017-09-08 · CVE-2014-5276

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Pro Chat Rooms Text Chat Rooms version 8.2.0

Description The issue allows remote authenticated users to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This can be achieved via two methods: (1) uploading a malicious profile picture or (2) manipulating the edit parameter in the profiles/index.php API endpoint.

Recommendations For Pro Chat Rooms Text Chat Rooms version 8.2.0, consider disabling the profile picture upload feature and restricting access to the profiles/index.php endpoint until a patch is available. Avoid using the edit parameter in the profiles/index.php endpoint to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-5276

Produtos afetados

Pro Chat Rooms Text Chat Rooms

Referências · 7

• 🔥 http://exploit-db.com/exploits/34275 · Exploit
• 🔥 https://exploit-db.com/exploits/34275 · Exploit
• 🔥 http://packetstormsecurity.com/files/127775/Pro-Chat-Rooms-8.2.0-XSS-Shell-Upload-SQL-Injection.html · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2014-08/0026.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-5276 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95125 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95126 · Nota