CVEvulnerability
CVE-2007-1394
10.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2007-03-10
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Description
Direct static code injection vulnerability in startsession.php in Flat Chat 2.0 allows remote attackers to execute arbitrary PHP code via the Chat Name field, which is inserted into online.txt and included by users.php. NOTE: some of these details are obtained from third party information.
Affected configurations
• flat chat flat chat 2.0
References
- http://osvdb.org/33890 osvdb.org
- http://secunia.com/advisories/24433 Exploit, Vendor Advisory
- http://www.securityfocus.com/bid/22865 Exploit, Vendor Advisory
- http://www.vupen.com/english/advisories/2007/0871 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32882 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/3428 www.exploit-db.com
- http://osvdb.org/33890 osvdb.org
- http://secunia.com/advisories/24433 Exploit, Vendor Advisory
- http://www.securityfocus.com/bid/22865 Exploit, Vendor Advisory
- http://www.vupen.com/english/advisories/2007/0871 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32882 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/3428 www.exploit-db.com