PT-2005-2598 · Phpmychat · Phpmychat

Megasky · Published 2005-05-16 · Updated 2018-10-19 · CVE-2005-1619

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHPMyChat version 0.14.5

Description The issue allows remote attackers to inject arbitrary web script or HTML commands via the FontName parameter in certain PHP files, specifically start page.css.php3 (also known as start-page.css.php3) or style.css.php3.

Recommendations For PHPMyChat version 0.14.5, consider restricting access to the FontName parameter in the affected PHP files until a patch is available. As a temporary workaround, avoid using the FontName parameter in the vulnerable API endpoints or files.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2005-1619

Affected Products

Phpmychat

References · 7

• 🔥 https://exploit-db.com/exploits/25660 · Exploit
• 🔥 https://exploit-db.com/exploits/25659 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-1619 · Security Note
• http://securityfocus.com/bid/13628 · Note
• http://securityfocus.com/archive/1/484575/100/0/threaded · Note
• http://securityfocus.com/bid/13627 · Note
• http://marc.info/?l=bugtraq&m=111602076500031&w=2 · Note