FlashChat Adminips.PHP Remote File Include Vulnerability
BID:18480
Info
FlashChat Adminips.PHP Remote File Include Vulnerability
| Bugtraq ID: | 18480 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 16 2006 12:00AM |
| Updated: | Sep 12 2006 05:47PM |
| Credit: | SpC-x is credited with discovering this vulnerability. |
| Vulnerable: |
TUFaT FlashChat 4.6.1 TUFaT FlashChat 4.6 TUFaT FlashChat 4.5.7 |
| Not Vulnerable: |
TUFaT FlashChat 4.6.2 |
Discussion
FlashChat Adminips.PHP Remote File Include Vulnerability
FlashChat is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input to the application.
An attacker may leverage this issue to have an arbitrary remote file containing malicious script code execute in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system. Other attacks are also possible.
FlashChat is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input to the application.
An attacker may leverage this issue to have an arbitrary remote file containing malicious script code execute in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system. Other attacks are also possible.
Exploit / POC
FlashChat Adminips.PHP Remote File Include Vulnerability
Attackers can exploit this issue via a web client.
Attackers can exploit this issue via a web client.
Solution / Fix
FlashChat Adminips.PHP Remote File Include Vulnerability
Solution:
The vendor has released version 4.6.2 to address this issue.
Please see the references section for more information.
mailto:[email protected]
Solution:
The vendor has released version 4.6.2 to address this issue.
Please see the references section for more information.
mailto:[email protected]