PT-2014-8777 · X7 · X7 Chat

Published 2014-11-20 · Updated 2017-09-08 · CVE-2014-8998

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions X7 Chat versions 2.0.0 through 2.0.5.1

Description The issue allows remote authenticated users to execute arbitrary PHP code via a crafted HTTP header to "index.php", which is processed by the preg replace function with the eval switch. This can lead to code execution.

Recommendations For X7 Chat versions 2.0.0 through 2.0.5.1, consider disabling the preg replace function with the eval switch in the lib/message.php file until a patch is available. Restrict access to the index.php file to minimize the risk of exploitation. Avoid using the eval switch in the preg replace function to prevent arbitrary code execution.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2014-8998

Affected Products

X7 Chat

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/x7chat2_php_exec.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/128964/X7-Chat-2.0.5-lib-message.php-preg_replace-PHP-Code-Execution.html · Exploit
• 🔥 http://exploit-db.com/exploits/35183 · Exploit
• 🔥 https://exploit-db.com/exploits/35183 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-8998 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8998 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98513 · Note
• http://securityfocus.com/bid/71014 · Note