MyChat Plus Multiple Vulnerabilities

Published: 2011-05-16 13:25:30

CVSS Base Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N

Detection Type:
Remote Vulnerability

Impact:
Successful exploitation will allow attacker to cause SQL Injection attack, gain sensitive information about the database used by the web application or can cause arbitrary code execution inside the context of the web application.

Affected Versions:
phpMyChat Plus version 1.93

Technical Details:
The flaws are due to: - Improper sanitization of user supplied input through the 'CookieUsername' and 'CookieStatus' parameter in Cookie. - Improper sanitization of user supplied input through the 'pmc_password' parameter in a printable action to avatar.php.

Recommendations:
Upgrade to version 1.94 or later.

Solution Type:
Vendor Patch

Summary:
This host is running MyChat Plus and is prone to multiple vulnerabilities.

References:

http://www.exploit-db.com/exploits/17213/
http://www.rxtx.nl/webapps-phpmychat-plus-1-93-multiple-vulnerabilities/
http://www.l33thackers.com/Thread-webapps-phpMyChat-Plus-1-93-Multiple-Vulnerabilities
http://sourceforge.net/projects/phpmychat

Search
Severity
Medium
CVSS Score
5.0

You never have to pay for a vulnerability scanning and management software again.

Tired of paying a subscription 'per asset' or 'per IP'? Well you can officially cancel your current subscription. Mageni provides a free, open source and enterprise-ready vulnerability scanning and management platform which helps you to find, prioritize, remediate and manage your vulnerabilities. It is free and always will be.