phpmychat-xssrfi.txt

Application : phpMyChat v0.14.5 Email ; [email protected] Website: http://phpmychat.sourceforge.net/ Many webhosting companies are offering this version of phpMychat in their cpanel : ---------------------------- | Remote File Inclusion: | ----------------------------...

RFI and Multiple XSS in PhpMyChat

Application : phpMyChat 0.14.5 Email ; [email protected] Website: http://phpmychat.sourceforge.net/ Many webhosting companies are offering this version of phpMychat in their cpanel : ---------------------------- | Remote File Inclusion: | ----------------------------...

phpMyChat 0.14.5 - 'chat/deluser.php3?LIMIT' Cross-Site Scripting

source: https://www.securityfocus.com/bid/26698/info phpMyChat is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

phpMyChat 0.14.5 - chatdeluser.php3?LIMIT Cross-Site Scripting

phpMyChat 0.14.5 - chatdeluser.php3?LIMIT Cross-Site Scripting source: https://www.securityfocus.com/bid/26698/info phpMyChat is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute...

phpMyChat 0.14.5 - chatusers_popupL.php3 Multiple Cross-Site Scripting Vulnerabilities

phpMyChat 0.14.5 - chatuserspopupL.php3 Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/26698/info phpMyChat is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these...

phpMyChat 0.14.5 - '/chat/users_popupL.php3' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/26698/info phpMyChat is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

CVE-2004-2716

CVE-2004-2716 describes multiple SQL injection vulnerabilities in PHPMyChat 0.14.5’s usersL.php3, allowing remote attackers to execute arbitrary SQL commands via parameters (sortBy, sortOrder, startReg, U, LastCheck, R). The underlying issue is unsafely constructed SQL queries in that script, ena...

CVE-2004-2717

Multiple directory traversal vulnerabilities in admin.php3 in PHPMyChat 0.14.5 allow remote attackers with administrative privileges to read arbitrary files via a .. dot dot in the 1 sheet and 2 What parameters...

CVE-2004-2715

edituser.php3 in PHPMyChat 0.14.5 allow remote attackers to bypass authentication and gain administrative privileges by setting the donotlogin parameter to false...

CVE-2004-2718

PHPMyChat 0.14.5 does not remove or protect setup.php3 after installation, which allows attackers to obtain sensitive information including database passwords via a direct request...

CVE-2004-2717

Technical details for CVE-2004-2717 are not publicly available in the provided documents; monitor for updates from Vulners and related advisories.

CVE-2004-2715

CVE-2004-2715 affects PHPMyChat 0.14.5 where edituser.php3 allows remote attackers to bypass authentication and gain administrative privileges by setting the do_not_login parameter to false. The root cause is a parameter-based authentication bypass in the admin workflow, enabling escalation of pr...

CVE-2004-2718

PHPMyChat 0.14.5 is affected by CVE-2004-2718: an issue where setup.php3 is not removed or protected after installation, allowing direct requests to reveal sensitive information such as database passwords. Impact is partial confidentiality loss as described; no exploitation details or active expl...

CVE-2004-2717: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in admin.php3 in PHPMyChat 0.14.5 allow remote attackers with administrative privileges to read arbitrary files via a .. dot dot in the 1 sheet and 2 What parameters...

CVE-2004-2718: Undefined Security Weakness

PHPMyChat 0.14.5 does not remove or protect setup.php3 after installation, which allows attackers to obtain sensitive information including database passwords via a direct request...

CVE-2004-2715: Improper Authentication

edituser.php3 in PHPMyChat 0.14.5 allow remote attackers to bypass authentication and gain administrative privileges by setting the donotlogin parameter to false...

CVE-2004-2716: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in usersL.php3 in PHPMyChat 0.14.5 allow remote attackers to execute arbitrary SQL commands via the 1 sortBy, 2 sortOrder, 3 startReg, 4 U, 5 LastCheck , and 6 R parameters...

CVE-2007-2477

PHP remote file inclusion vulnerability in phpMyChat.php3 in phpMyChat 0.14.5 allows remote attackers to execute arbitrary PHP code via a URL in the ChatPath parameter. NOTE: this has been disputed by multiple third parties and CVE because $ChatPath is set to a constant value...

Remote file inclusion

PHP remote file inclusion vulnerability in phpMyChat.php3 in phpMyChat 0.14.5 allows remote attackers to execute arbitrary PHP code via a URL in the ChatPath parameter. NOTE: this has been disputed by multiple third parties and CVE because $ChatPath is set to a constant value...

PT-2007-3801 · Phpmychat · Phpmychat

Name of the Vulnerable Software and Affected Versions: phpMyChat version 0.14.5 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the ChatPath parameter in the phpMyChat.php3 file. However, it has been disputed by multiple third parties because the $ChatPat...