critical10.0Public exploit code
CVE-2007-2147
admin/options.php in Stephen Craton (aka WiredPHP) Chatness 2.5.3 and earlier does not check for administrative credentials, which allows remote attackers to r…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Chatness 2.5.3 - '/options.php/save.php' Remote Code Execution2007-04-12 · webapps · php · Verified
Impact
admin/options.php in Stephen Craton (aka WiredPHP) Chatness 2.5.3 and earlier does not check for administrative credentials, which allows remote attackers to read and modify the classes/vars.php and classes/varstuff.php configuration files via direct requests.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Stephen Craton | Chatness | through 2.5.3 |
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/24873
- http://securityreason.com/securityalert/2595
- http://www.securityfocus.com/archive/1/465547/100/0/threaded
- http://www.vupen.com/english/advisories/2007/1386
- http://secunia.com/advisories/24873
- http://securityreason.com/securityalert/2595
- http://www.securityfocus.com/archive/1/465547/100/0/threaded
- http://www.vupen.com/english/advisories/2007/1386