CVE-2007-2147

admin/options.php in Stephen Craton (aka WiredPHP) Chatness 2.5.3 and earlier does not check for administrative credentials, which allows remote attackers to read and modify the classes/vars.php and classes/varstuff.php configuration files via direct requests.

CVSS v2.0

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

3.42% chance of exploitation in the next 30 days, 88th percentile

Published

2007-04-19

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/3725

References

• CVE Record
• NVD entry

Related

• CVE-2007-2146
• CVE-2007-2148
• CVE-2007-2145
• CVE-2007-2149
• CVE-2007-2144
• CVE-2007-2154