VYPR
← All advisories
Unrated severityNVD Advisory· Published Apr 19, 2007· Updated Jun 16, 2026

CVE-2007-2148

CVE-2007-2148

Description

Direct static code injection vulnerability in admin/save.php in Stephen Craton (aka WiredPHP) Chatness 2.5.3 and earlier allows remote authenticated administrators to inject PHP code into .html files via the html parameter, as demonstrated by head.html and foot.html, which are included and executed upon a direct request for index.php. NOTE: a separate vulnerability could be leveraged to make this issue exploitable by remote unauthenticated attackers.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Stephen Craton/Chatness2 versions
    cpe:2.3:a:stephen_craton:chatness:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:stephen_craton:chatness:*:*:*:*:*:*:*:*range: <=2.5.3
    • (no CPE)range: <=2.5.3

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.