PT-2005-1890 · Php · Phpopenchat

Published 2005-03-24 · Updated 2018-10-19 · CVE-2005-0862

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHPOpenChat versions 3.0.1 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved via several parameters to different PHP files, including the phpbb root path parameter to files such as 'poc loginform.php' or 'phpbb/poc.php', the poc root path parameter to files like 'phpbb/poc.php', 'phpnuke/ENGLISH poc.php', 'phpnuke/poc.php', or 'yabbse/poc.php', and the sourcedir parameter to 'yabbse/poc.php'.

Recommendations For PHPOpenChat versions 3.0.1 and earlier, consider disabling the phpbb root path, poc root path, and sourcedir parameters in the affected PHP files until a patch is available. Restrict access to the vulnerable PHP files, such as 'poc loginform.php', 'phpbb/poc.php', 'phpnuke/ENGLISH poc.php', 'phpnuke/poc.php', and 'yabbse/poc.php', to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-0862

Affected Products

Phpopenchat

References · 15

• 🔥 https://exploit-db.com/exploits/25227 · Exploit
• 🔥 http://securitytracker.com/id?1013434 · Exploit
• 🔥 http://zone-h.org/advisories/read/id=7310 · Exploit
• 🔥 https://exploit-db.com/exploits/25229 · Exploit
• 🔥 https://exploit-db.com/exploits/25228 · Exploit
• http://secunia.com/advisories/14600 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0862 · Security Note
• http://osvdb.org/14807 · Note
• http://securityfocus.com/archive/1/465237/100/0/threaded · Note
• http://albanianhaxorz.org/advisory/phpopenchaten.txt · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19721 · Note
• http://osvdb.org/14809 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0862 · Note
• http://osvdb.org/14808 · Note
• http://securityfocus.com/bid/12817 · Note