Vulnerabilities > CVE-2007-2147 - Remote Security vulnerability in Chatness

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
low complexity
stephen-craton
critical
exploit available
NVD
Published: 2007-04-19
Updated: 2018-10-16

Summary

admin/options.php in Stephen Craton (aka WiredPHP) Chatness 2.5.3 and earlier does not check for administrative credentials, which allows remote attackers to read and modify the classes/vars.php and classes/varstuff.php configuration files via direct requests.

Vulnerable Configurations

Part Description Count
Application
Stephen_Craton
1

Exploit-Db

descriptionChatness <= 2.5.3 (options.php/save.php) Remote Code Execution Exploit. CVE-2007-2147,CVE-2007-2148,CVE-2007-2149. Webapps exploit for php platform
idEDB-ID:3725
last seen2016-01-31
modified2007-04-12
published2007-04-12
reporterGammarays
sourcehttps://www.exploit-db.com/download/3725/
titleChatness <= 2.5.3 options.php/save.php Remote Code Execution Exploit

References