Exploit 123 Flash Chat 5.0 - Remote Code Injection

Exploiter

Хакер
34,644
0
18 Дек 2022
EDB-ID
27121
Проверка EDB
  1. Пройдено
Автор
JESUS OLMOS GONZALEZ
Тип уязвимости
WEBAPPS
Платформа
PHP
CVE
cve-2006-0418
Дата публикации
2006-01-24
Код:
source: https://www.securityfocus.com/bid/16360/info

123 Flash Chat is prone to an arbitrary code injection weakness.

An attacker can influence the value of a variable that is insecurely passed to an 'eval()' call.

Successful exploitation may allow attackers to take complete control of the application and potentially carry out other attacks against the vulnerable server hosting the client, including remote unauthorized access.

Exploitation of this vulnerability likely depends on the existence of other content injection issues in the site hosting the application. An attacker would exploit other input validation vulnerabilities such as HTML injection or cross-site scripting to supply the malicious value for a variable.

123 Flash Chat 5.1 and prior versions are affected by this issue.

The following string may be supplied as a username to gain administrative privileges:

x;user.name= a;user.name=ADMIN_AVATAR_NAME;
 
Источник
www.exploit-db.com

Похожие темы