PT-2007-2788 · Flatchat · Flatchat

Dj7Xpl · Published 2007-03-10 · Updated 2017-10-11 · CVE-2007-1394

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Flat Chat version 2.0

Description A direct static code injection issue exists, allowing remote attackers to execute arbitrary PHP code. This is achieved via the Chat Name field, which is inserted into online.txt and included by users.php.

Recommendations For Flat Chat version 2.0, consider restricting access to the startsession.php file until a patch is available. As a temporary workaround, avoid using the Chat Name field in the affected startsession.php file to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2007-1394

Affected Products

Flatchat

References · 7

• 🔥 http://secunia.com/advisories/24433 · Exploit
• 🔥 http://securityfocus.com/bid/22865 · Exploit
• 🔥 https://exploit-db.com/exploits/3428 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1394 · Security Note
• http://vupen.com/english/advisories/2007/0871 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32882 · Note
• http://osvdb.org/33890 · Note