OxYProject Edit Chat History Remote Code Execution Vulnerability

Bugtraq ID:	28992
Class:	Input Validation Error
CVE:	CVE-2008-6651
Remote:	Yes
Local:	No
Published:	Apr 30 2008 12:00AM
Updated:	Apr 16 2015 06:01PM
Credit:	GoLd_M
Vulnerable:	OxYProject OxYProject 0.85
Not Vulnerable:

OxYProject Edit Chat History Remote Code Execution Vulnerability

OxYProject is prone to a vulnerability that lets remote attackers execute arbitrary code because the application fails to sanitize user-supplied input.

An attacker can leverage this issue to execute arbitrary PHP code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.

OxYProject 0.85 is vulnerable; other versions may also be affected.

OxYProject Edit Chat History Remote Code Execution Vulnerability

Attackers may exploit this issue through a browser.

The following exploit code is available.

• /data/vulnerabilities/exploits/28992.php

OxYProject Edit Chat History Remote Code Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

OxYProject Edit Chat History Remote Code Execution Vulnerability

References:

• OxYProject Homepage (OxYProject)