123 Flash Chat Remote Code Injection Weakness
BID:16360
Info
123 Flash Chat Remote Code Injection Weakness
| Bugtraq ID: | 16360 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 24 2006 12:00AM |
| Updated: | Feb 07 2006 08:55PM |
| Credit: | Discovered by Jesus Olmos Gonzalez. |
| Vulnerable: |
TopLang Software 123 Flash Chat Server 5.0 TopCMM Computing 123 Flash Chat Server 5.1 |
| Not Vulnerable: |
TopCMM Computing 123 Flash Chat Server 5.1 _2 |
Discussion
123 Flash Chat Remote Code Injection Weakness
123 Flash Chat is prone to an arbitrary code injection weakness.
An attacker can influence the value of a variable that is insecurely passed to an 'eval()' call.
Successful exploitation may allow attackers to take complete control of the application and potentially carry out other attacks against the vulnerable server hosting the client, including remote unauthorized access.
Exploitation of this vulnerability likely depends on the existence of other content injection issues in the site hosting the application. An attacker would exploit other input validation vulnerabilities such as HTML injection or cross-site scripting to supply the malicious value for a variable.
123 Flash Chat 5.1 and prior versions are affected by this issue.
123 Flash Chat is prone to an arbitrary code injection weakness.
An attacker can influence the value of a variable that is insecurely passed to an 'eval()' call.
Successful exploitation may allow attackers to take complete control of the application and potentially carry out other attacks against the vulnerable server hosting the client, including remote unauthorized access.
Exploitation of this vulnerability likely depends on the existence of other content injection issues in the site hosting the application. An attacker would exploit other input validation vulnerabilities such as HTML injection or cross-site scripting to supply the malicious value for a variable.
123 Flash Chat 5.1 and prior versions are affected by this issue.
Exploit / POC
123 Flash Chat Remote Code Injection Weakness
The following string may be supplied as a username to gain administrative privileges:
x;user.name= a;user.name=ADMIN_AVATAR_NAME;
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
The following string may be supplied as a username to gain administrative privileges:
x;user.name= a;user.name=ADMIN_AVATAR_NAME;
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Solution / Fix
123 Flash Chat Remote Code Injection Weakness
Solution:
The vendor has released 5.1_2 to address this issue.
TopLang Software 123 Flash Chat Server 5.0
TopCMM Computing 123 Flash Chat Server 5.1
Solution:
The vendor has released 5.1_2 to address this issue.
TopLang Software 123 Flash Chat Server 5.0
-
TopCMM Computing 123 Flash Chat Server Software Download
http://www.123flashchat.com/download.html
TopCMM Computing 123 Flash Chat Server 5.1
-
TopCMM Computing 123 Flash Chat Server Software Download
http://www.123flashchat.com/download.html
References
123 Flash Chat Remote Code Injection Weakness
References:
References:
- 123 Flash Chat Homepage (TopCMM Software)
- 123 flash chat server software 5.1_2 released! (TopCMM Computing)
- [ISecAuditors Advisories] Arbitrary flash code remote execution in 123flashchat (ISecAuditors Security Advisories