activeCollab Chat Module Arbitrary PHP Code Execution (CVE-2012-6554)

A code execution vulnerability exists in Chat module for activeCollab.The vulnerability is due to a flaw that is triggered by the pregreplace function.A remote attacker may exploit this vulnerability by evaluating a string with complex curly syntax, allowing for the execution of arbitrary code...

CVE-2012-6554

Summary: CVE-2012-6554 is an arbitrary PHP code execution in the Active Collab Chat Module for versions prior to 1.5.2, exploitable by remote authenticated users via the message[message_text] field in chat/add_messag. The root cause is improper handling during preg_replace with the eval switch, e...

CVE-2012-6554

creationtimestamp| type| source ---|---|--- 2012-05-19 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/18898 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/activecollabchat.rb 2025-02-06 03:13:41+00:00| seen|...