vulnwire
6.5med

CVE-2007-21481 exploit

Direct static code injection vulnerability in admin/save.php in Stephen Craton (aka WiredPHP) Chatness 2.5.3 and earlier allows remote auth…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
6.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.0%
percentile 81%
Public exploits
1
Exploit-DB

Direct static code injection vulnerability in admin/save.php in Stephen Craton (aka WiredPHP) Chatness 2.5.3 and earlier allows remote authenticated administrators to inject PHP code into .html files via the html parameter, as demonstrated by head.html and foot.html, which are included and executed upon a direct request for index.php. NOTE: a separate vulnerability could be leveraged to make this issue exploitable by remote unauthenticated attackers.

Exploit prediction (EPSS)

1.99% probability of exploitation in the next 30 days, higher than 81% of all scored CVEs.

Exploits and detections

  • EDB-3725 Chatness 2.5.3 - '/options.php/save.php' Remote Code Execution · webapps · 2007-04-12

CVSS scores

Assigned byVersionScoreVector
NVD2.06.5AV:N/AC:L/Au:S/C:P/I:P/A:P

References

  • securityfocus.com /archive/1/465547/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • secunia.com /advisories/24873 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • vupen.com /english/advisories/2007/1386 · vdb-entry, x_refsource_VUPEN, x_transferred
  • securityreason.com /securityalert/2595 · third-party-advisory, x_refsource_SREASON, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.