PT-2009-6049 · Fiji Web Design · Fiji Web Design Ajax Chat

Published 2009-10-28 · Updated 2009-10-28 · CVE-2009-3822

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Fiji Web Design Ajax Chat (com ajaxchat) component version 1.0 for Joomla!

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[mosConfig absolute path] parameter to the "tests/ajcuser.php" endpoint.

Recommendations For Fiji Web Design Ajax Chat (com ajaxchat) component version 1.0, consider restricting access to the tests/ajcuser.php endpoint until a patch is available. Avoid using the GLOBALS[mosConfig absolute path] parameter in the affected endpoint to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-3822

Affected Products

Fiji Web Design Ajax Chat

References · 6

• 🔥 http://packetstormsecurity.org/0910-exploits/joomlaajaxchat-rfi.txt · Exploit
• 🔥 https://exploit-db.com/exploits/9888 · Exploit
• 🔥 http://securityfocus.com/bid/36731 · Exploit
• http://secunia.com/advisories/37087 · Vendor Advisory
• http://vupen.com/english/advisories/2009/2968 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3822 · Security Note