critical10.0Public exploit code
CVE-2007-1394
Direct static code injection vulnerability in startsession.php in Flat Chat 2.0 allows remote attackers to execute arbitrary PHP code via the Chat Name field, …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Flat Chat 2.0 - 'include online.txt' Remote Code Execution2007-03-07 · webapps · php · Verified
Impact
Direct static code injection vulnerability in startsession.php in Flat Chat 2.0 allows remote attackers to execute arbitrary PHP code via the Chat Name field, which is inserted into online.txt and included by users.php. NOTE: some of these details are obtained from third party information.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Flat Chat | Flat Chat | Version 2.0 |
References
- NVD record
- CVE.org record
- http://osvdb.org/33890
- http://secunia.com/advisories/24433
- http://www.securityfocus.com/bid/22865
- http://www.vupen.com/english/advisories/2007/0871
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32882
- https://www.exploit-db.com/exploits/3428
- http://osvdb.org/33890
- http://secunia.com/advisories/24433
- http://www.securityfocus.com/bid/22865
- http://www.vupen.com/english/advisories/2007/0871
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32882
- https://www.exploit-db.com/exploits/3428