CVE-2006-5837: Code Injection

Published Nov 10, 2006

Updated

Static code injection vulnerability in chatpanel.php in the SimpleChat 1.0.0 module for iWare Professional CMS allows remote attackers to inject arbitrary PHP code into chatlog.php via the msg parameter.

Affected Software

1 affected component

SimpleChat SimpleChat=1.0.0

Event History

Nov 10, 2006

CVE Published

01:07 AM

Data Sourced

via NVD·01:07 AM

DescriptionSeverityAffected Software

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

Description

Frequently Asked Questions

Who can exploit this issue?

The vector is network-accessible and requires no authentication, so a remote attacker who can reach the vulnerable chat functionality can attempt exploitation.

What input is involved in exploitation?

The vulnerable input is the msg parameter handled by chat_panel.php. Supplying crafted content can inject arbitrary PHP code into chat_log.php.

What is the potential impact?

Successful exploitation can result in arbitrary PHP code execution. The provided severity vector indicates potential confidentiality, integrity, and availability impact.

CVE-2006-5837: Code Injection

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What input is involved in exploitation?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What input is involved in exploitation?

What is the potential impact?