PT-2014-6388 · Pro Chat Rooms · Pro Chat Rooms Text Chat Rooms

Mike Manzotti · Published 2014-10-20 · Updated 2017-09-08 · CVE-2014-5276

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Pro Chat Rooms Text Chat Rooms version 8.2.0

Description The issue allows remote authenticated users to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This can be achieved via two methods: (1) uploading a malicious profile picture or (2) manipulating the edit parameter in the profiles/index.php API endpoint.

Recommendations For Pro Chat Rooms Text Chat Rooms version 8.2.0, consider disabling the profile picture upload feature and restricting access to the profiles/index.php endpoint until a patch is available. Avoid using the edit parameter in the profiles/index.php endpoint to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-5276

Affected Products

Pro Chat Rooms Text Chat Rooms

References · 7

• 🔥 http://exploit-db.com/exploits/34275 · Exploit
• 🔥 https://exploit-db.com/exploits/34275 · Exploit
• 🔥 http://packetstormsecurity.com/files/127775/Pro-Chat-Rooms-8.2.0-XSS-Shell-Upload-SQL-Injection.html · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2014-08/0026.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-5276 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95125 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95126 · Note