critical10.0
CVE-2024-36679
In the module "Module Live Chat Pro (All in One Messaging)" (livechatpro) <=8.4.0, a guest can perform PHP Code injection.
Impact
In the module "Module Live Chat Pro (All in One Messaging)" (livechatpro) <=8.4.0, a guest can perform PHP Code injection. Due to a predictable token, the method `Lcp::saveTranslations()` suffer of a white writer that can inject PHP code into a PHP file.
Affected products
| Product | Affected versions |
|---|---|
| One Messaging)" (Livechatpro) | through 8.4.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.