PT-2006-1483 · Sleeperchat · Sleeperchat

Published 2006-01-25 · Updated 2017-07-20 · CVE-2006-0416

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SleeperChat versions 0.3f and earlier

Description The issue allows remote attackers to bypass authentication and create new entries. This is achieved via the txt parameter to API endpoints such as "chat no.php" and "chat if.php".

Recommendations For SleeperChat versions 0.3f and earlier, consider restricting access to the "chat no.php" and "chat if.php" API endpoints to minimize the risk of exploitation. Avoid using the txt parameter in these endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2006-0416

Affected Products

Sleeperchat

References · 3

• 🔥 http://securitytracker.com/id?1015525 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0416 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24357 · Note