PT-2004-3607 · Phpmychat · Phpmychat

Published 2004-12-31 · Updated 2009-04-03 · CVE-2004-2717

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHPMyChat version 0.14.5

Description The issue concerns directory traversal vulnerabilities in the admin.php3 file of PHPMyChat. These vulnerabilities allow remote attackers with administrative privileges to read arbitrary files. This is achieved by including a .. (dot dot) in the sheet and What parameters.

Recommendations For PHPMyChat version 0.14.5, consider restricting access to the admin.php3 file until a patch is available, and avoid using the sheet and What parameters with untrusted input.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2004-2717

Affected Products

Phpmychat

References · 7

• 🔥 https://exploit-db.com/exploits/24217 · Exploit
• 🔥 http://securityfocus.com/bid/10556 · Exploit
• http://secunia.com/advisories/11894 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-2717 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2004-06/0252.html · Note
• http://osvdb.org/7150 · Note
• http://securitytracker.com/id?1010515 · Note