Lucene search

[email protected]CVE-2014-8998

HistoryNov 20, 2014 - 1:55 p.m.

CVE-2014-8998

2014-11-2013:55:00

CWE-94

[email protected]

web.nvd.nist.gov

cve

x7 chat

php code execution

security vulnerability

nvd

7.9 High

AI Score

Confidence

Low

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.954 High

EPSS

Percentile

99.4%

JSON

lib/message.php in X7 Chat 2.0.0 through 2.0.5.1 allows remote authenticated users to execute arbitrary PHP code via a crafted HTTP header to index.php, which is processed by the preg_replace function with the eval switch.

CPENameOperatorVersion
x7chat:x7_chatx7chat x7 chateq2.0.1
x7chat:x7_chatx7chat x7 chateq2.0.0
x7chat:x7_chatx7chat x7 chateq2.0.4.1
x7chat:x7_chatx7chat x7 chateq2.0.5
x7chat:x7_chatx7chat x7 chateq2.0.4.4
x7chat:x7_chatx7chat x7 chateq2.0.4.3
x7chat:x7_chatx7chat x7 chateq2.0.4
x7chat:x7_chatx7chat x7 chateq2.0.3
x7chat:x7_chatx7chat x7 chateq2.0.2
x7chat:x7_chatx7chat x7 chateq2.0.5.1

CPE	Name	Operator	Version
x7chat:x7_chat	x7chat x7 chat	eq	2.0.1
x7chat:x7_chat	x7chat x7 chat	eq	2.0.0
x7chat:x7_chat	x7chat x7 chat	eq	2.0.4.1
x7chat:x7_chat	x7chat x7 chat	eq	2.0.5
x7chat:x7_chat	x7chat x7 chat	eq	2.0.4.4
x7chat:x7_chat	x7chat x7 chat	eq	2.0.4.3
x7chat:x7_chat	x7chat x7 chat	eq	2.0.4
x7chat:x7_chat	x7chat x7 chat	eq	2.0.3
x7chat:x7_chat	x7chat x7 chat	eq	2.0.2
x7chat:x7_chat	x7chat x7 chat	eq	2.0.5.1

References

packetstormsecurity.com/files/128964/X7-Chat-2.0.5-lib-message.php-preg_replace-PHP-Code-Execution.html

www.exploit-db.com/exploits/35183

www.securityfocus.com/bid/71014

exchange.xforce.ibmcloud.com/vulnerabilities/98513

7.9 High

AI Score

Confidence

Low

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.954 High

EPSS

Percentile

99.4%

JSON

Related for CVE-2014-8998

cvelist1 prion1