Description
Directory traversal vulnerability in main.php in PCPIN Chat 5.0.4 and earlier allows remote authenticated users to include and execute arbitrary PHP code via a ".." (dot dot) in a language cookie, as demonstrated by uploading then accessing a smiliefile image that actually contains PHP code.
References
- 20060604 Re: PCPIN Chat <= 5.0.4 "login/language" remote cmmnds xctn mailing-list
- ADV-2006-1441 vdb-entry
- 1015968 vdb-entry
- 20060419 PCPIN Chat <= 5.0.4 "login/language" remote cmmnds xctn mailing-list
- 17632 vdb-entry
- pcpin-chat-main-file-include(25962) vdb-entry
- http://retrogod.altervista.org/pcpin_504_xpl.html
- 19708 third-party-advisory