« Volver al listado

CVE-2014-8998

Estado: ModificadaMedia (6.5)—

lib/message.php in X7 Chat 2.0.0 through 2.0.5.1 allows remote authenticated users to execute arbitrary PHP code via a crafted HTTP header to index.php, which is processed by the preg_replace function with the eval switch.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

X7chat — X7 Chat

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-8998",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-11-20T13:55:07.907",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/128964/X7-Chat-2.0.5-lib-message.php-preg_replace-PHP-Code-Execution.html",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.exploit-db.com/exploits/35183",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/71014",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98513",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.com/files/128964/X7-Chat-2.0.5-lib-message.php-preg_replace-PHP-Code-Execution.html",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.exploit-db.com/exploits/35183",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/71014",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98513",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "lib/message.php in X7 Chat 2.0.0 through 2.0.5.1 allows remote authenticated users to execute arbitrary PHP code via a crafted HTTP header to index.php, which is processed by the preg_replace function with the eval switch."
    },
    {
      "lang": "es",
      "value": "lib/message.php en X7 Chat 2.0.0 hasta 2.0.5.1 permite a usuarios remotos autenticados ejecutar código PHP arbitrario a través de una cabecera HTTP manipulada en index.php, lo cual es procesada por la función preg_replace con el switch eval."
    }
  ],
  "lastModified": "2026-06-17T00:17:38.090",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:x7chat:x7_chat:2.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0EE9C702-99D0-4D99-8479-3FDA0ABE1F1E"
            },
            {
              "criteria": "cpe:2.3:a:x7chat:x7_chat:2.0.0:a1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4C37FD3-A2D0-4F3D-A451-D318F1160DEB"
            },
            {
              "criteria": "cpe:2.3:a:x7chat:x7_chat:2.0.0:a2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9B3A12CB-E0B8-460E-8AFF-38F4038D89F1"
            },
            {
              "criteria": "cpe:2.3:a:x7chat:x7_chat:2.0.0:a3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B16D1C70-5AD8-4417-8A85-34D858F63592"
            },
            {
              "criteria": "cpe:2.3:a:x7chat:x7_chat:2.0.0:b1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "57E0CEAF-3425-457D-8BEB-1844968ECC5B"
            },
            {
              "criteria": "cpe:2.3:a:x7chat:x7_chat:2.0.0:b2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DA9CCE39-827E-403E-BB29-9AA032D978AF"
            },
            {
              "criteria": "cpe:2.3:a:x7chat:x7_chat:2.0.1:a1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B0775703-2E7E-474E-AF13-083BC92E0FDB"
            },
            {
              "criteria": "cpe:2.3:a:x7chat:x7_chat:2.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D25741B-DA95-434A-ACE7-68E67E177538"
            },
            {
              "criteria": "cpe:2.3:a:x7chat:x7_chat:2.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8ED94660-2267-4466-BFCB-FC1ED3A9EC66"
            },
            {
              "criteria": "cpe:2.3:a:x7chat:x7_chat:2.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C93B3F07-1CA8-445D-8488-251929ED6C35"
            },
            {
              "criteria": "cpe:2.3:a:x7chat:x7_chat:2.0.4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E51254DD-AFDC-4D2C-9206-B814B5FC2386"
            },
            {
              "criteria": "cpe:2.3:a:x7chat:x7_chat:2.0.4.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "29106DC5-15C2-4331-B3B2-5D7DB809A82A"
            },
            {
              "criteria": "cpe:2.3:a:x7chat:x7_chat:2.0.4.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DE980550-DE0E-417B-93E4-77E1BD7F10AC"
            },
            {
              "criteria": "cpe:2.3:a:x7chat:x7_chat:2.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40B44AAC-B349-4154-A5BC-6E438610E959"
            },
            {
              "criteria": "cpe:2.3:a:x7chat:x7_chat:2.0.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64F825FB-80F2-4282-A82D-916CB0B4BAB7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}