vulnwire
10.0crit

CVE-2007-13941 exploit

Direct static code injection vulnerability in startsession.php in Flat Chat 2.0 allows remote attackers to execute arbitrary PHP code via t…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
10.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.4%
percentile 91%
Public exploits
1
Exploit-DB

Direct static code injection vulnerability in startsession.php in Flat Chat 2.0 allows remote attackers to execute arbitrary PHP code via the Chat Name field, which is inserted into online.txt and included by users.php. NOTE: some of these details are obtained from third party information.

Exploit prediction (EPSS)

4.42% probability of exploitation in the next 30 days, higher than 91% of all scored CVEs.

Exploits and detections

  • EDB-3428 Flat Chat 2.0 - 'include online.txt' Remote Code Execution · webapps · 2007-03-07

CVSS scores

Assigned byVersionScoreVector
NVD2.010.0AV:N/AC:L/Au:N/C:C/I:C/A:C

References

  • vupen.com /english/advisories/2007/0871 · vdb-entry, x_refsource_VUPEN, x_transferred
  • exploit-db.com /exploits/3428 · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • secunia.com /advisories/24433 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /bid/22865 · vdb-entry, x_refsource_BID, x_transferred
  • osvdb.org /33890 · vdb-entry, x_refsource_OSVDB, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/32882 · vdb-entry, x_refsource_XF, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.