PHPMyChat Multiple Cross-Site Scripting Vulnerabilities

Bugtraq ID:	15679
Class:	Input Validation Error
CVE:	CVE-2005-3991
Remote:	Yes
Local:	No
Published:	Dec 02 2005 12:00AM
Updated:	Dec 18 2007 08:05PM
Credit:	Louis Wang is credited with the discovery of this vulnerability.
Vulnerable:	phpHeaven phpMyChat 0.14.6 Nicholas Hoizey phpMyChat 0.14.5
Not Vulnerable:

PHPMyChat Multiple Cross-Site Scripting Vulnerabilities

phpMyChat is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

phpMyChat 0.14.5 is vulnerable; other versions may also be affected.

PHPMyChat Multiple Cross-Site Scripting Vulnerabilities

No exploit is required.

The following proof-of-concept URIs are available:

http://www.example.com/phpmychat/chat/config/start_page.css.php?medium=><script>alert(29837274289742472);</script>&FontName=1
http://www.example.com/phpmychat/chat/config/style.css.php?medium=><script>alert(29837274289742472);</script>&FontName=1
http://www.example.com/phpmychat/chat/users_popupL.php?From="><script>alert(29837274289742472);</script>>&L=english&LastCheck=1133281246&B=0

PHPMyChat Multiple Cross-Site Scripting Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

PHPMyChat Multiple Cross-Site Scripting Vulnerabilities

References:

• phpMyChat Web Site (phpMyChat)
  
• phpMyChat XSS Vulnerability (Louis Wang)
  
• RFI and Multiple XSS in PhpMyChat ([email protected] )