OSVDB ID: 22440 Title: 123 Flash Chat Server Username Traversal Arbitrary File Access |
Info |
|
|
Dates |
||||
|
|
Description |
123 Flash Chat Server contains a flaw that allows a remote attacker to write to files outside of the web path. The issue is due to the server not properly sanitizing user input when creating new users, specifically traversal style attacks (../../) supplied via the "user" variable. This flaw may allow a malicious user to gain access to unauthorized privileges and files. |
Classification |
Location:
Remote / Network Access
Attack Type: Input Manipulation Impact: Loss of Integrity Exploit: Exploit Public Disclosure: OSVDB Verified, Vendor Verified OSVDB: Web Related |
Solution |
Upgrade to version 5.1_2 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. |
Products |
|
References |
|
Credit |
|
isecauditors.com - Internet Security Auditors, S.L.