PT-2006-1300 · Shanghai Topcmm · Shanghai Topcmm 123 Flash Chat Server

Published 2006-01-16 · Updated 2017-07-20 · CVE-2006-0223

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Shanghai TopCMM 123 Flash Chat Server Software version 5.1

Description The issue allows attackers to create or overwrite arbitrary files on the server by utilizing ".." (dot dot) sequences in the username field, which is a directory traversal vulnerability.

Recommendations For Shanghai TopCMM 123 Flash Chat Server Software version 5.1, consider restricting the use of the username field to prevent directory traversal attacks until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2006-0223

Affected Products

Shanghai Topcmm 123 Flash Chat Server

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2006-0223 · Security Note
• http://secunia.com/advisories/18455 · Vendor Advisory
• http://securityfocus.com/bid/16235 · Patch
• http://vupen.com/english/advisories/2006/0198 · Vendor Advisory
• http://123flashchat.com/flash-chat-server-v512.html · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24137 · Note
• http://osvdb.org/22440 · Note