CVE-2008-6502 Directory traversal vulnerability in Pro Chat Rooms 3.0.2 allows remote authenticated users to select an arbitrary local PHP script as an avatar via a .. (dot dot) in the avatar parameter, and cause o...
MediumCVSS 4.6
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in Pro Chat Rooms 3.0.2 allows remote authenticated users to select an arbitrary local PHP script as an avatar via a .. (dot dot) in the avatar parameter, and cause other users to execute this script by using sendData.php to send a message to (1) an individual user or (2) a room, leading to cross-site request forgery (CSRF), cross-site scripting (XSS), or other impacts.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| prochatrooms pro chat rooms | = 3.0.2 | No fix listed |
References
- 50697 vdb-entry
- 33088 third-party-advisory vendor-advisory
- prochatrooms-senddata-xss(47242) vdb-entry
- 7409 exploit