PT-2024-21926 · Unknown · Livehelperchat

Hebing123 · Published 2024-02-28 · Updated 2024-07-03 · CVE-2024-27516

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions livehelperchat versions prior to 4.34

Description A Server-Side Template Injection (SSTI) issue allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhc web/modules/lhfaq/faqweight.php.

Recommendations For versions prior to 4.34, update to version 4.34 or later to resolve the issue. As a temporary workaround, consider restricting access to the lhc web/modules/lhfaq/faqweight.php module until a patch is available. Avoid using the search parameter in the affected module until the issue is resolved.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-27516

GHSA-V4CP-2Q7V-HG9Q

Affected Products

Livehelperchat

References · 9

• https://github.com/LiveHelperChat/livehelperchat/issues/2054 · Vendor Advisory
• https://github.com/LiveHelperChat/livehelperchat/commit/a61d231526a36d4a7d8cc957914799ee1f9db0ab · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-27516 · Security Note
• https://osv.dev/vulnerability/GHSA-v4cp-2q7v-hg9q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27516 · Vendor Advisory
• https://github.com/LiveHelperChat/livehelperchat · Note
• https://twitter.com/VulmonFeeds/status/1763092780425871429 · Twitter Post
• https://twitter.com/CVEnew/status/1762847271270396007 · Twitter Post
• https://t.me/cvenotify/74403 · Telegram Post