PT-2005-1891 · Php · Phpopenchat

Published 2005-03-24 · Updated 2017-07-11 · CVE-2005-0863

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHPOpenChat versions 3.x

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved via specific parameters in certain PHP files, including the chatter parameter to regulars.php or the chatter, chatter1, chatter2, chatter3, or chatter4 parameters to register.php.

Recommendations For PHPOpenChat version 3.x, consider validating and sanitizing user input for the chatter, chatter1, chatter2, chatter3, and chatter4 parameters in register.php and the chatter parameter in regulars.php to prevent arbitrary web script or HTML injection. As a temporary workaround, restrict access to regulars.php and register.php to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-0863

Affected Products

Phpopenchat

References · 7

• 🔥 https://exploit-db.com/exploits/25236 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-0863 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19748 · Note
• http://seclists.org/lists/bugtraq/2005/Mar/0331.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0863 · Note
• http://secunia.com/advisories/14651 · Note
• http://securityfocus.com/bid/12841 · Note