CVE-2007-1394 EXPLOIT
10.0
HIGH · CVSS 2.0 · EPSS 4.4% (pctl 91)
Patch early
A public exploit exists.
Description
Direct static code injection vulnerability in startsession.php in Flat Chat 2.0 allows remote attackers to execute arbitrary PHP code via the Chat Name field, which is inserted into online.txt and included by users.php. NOTE: some of these details are obtained from third party information.
Scoring
| CVSS | 10.0 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
| EPSS | 4.42% — more likely to be exploited than 91% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2007-03-10 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| flat chat | flat chat |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Flat Chat 2.0 - 'include online.txt' Remote Code Execution | 2007-03-07 |
References
- http://osvdb.org/33890
- http://secunia.com/advisories/24433
- http://www.securityfocus.com/bid/22865
- http://www.vupen.com/english/advisories/2007/0871
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32882
- https://www.exploit-db.com/exploits/3428
- http://osvdb.org/33890
- http://secunia.com/advisories/24433
- http://www.securityfocus.com/bid/22865
- http://www.vupen.com/english/advisories/2007/0871
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32882
- https://www.exploit-db.com/exploits/3428
→ the Explorer · watch your stack · NVD