Gammarays has discovered two vulnerabilities in Chatness, which can be exploited by malicious people to bypass certain security restrictions and by malicious users to compromise a vulnerable system.

1) The vulnerability is caused due to improper authentication verification in admin/options.php. This can be exploited to retrieve the administrator username and password.

2) Input passed to the "html" parameter in admin/save.php is not properly sanitised before it is written to head.html or foot.html. Both files are included in index.php, which can be exploited to execute arbitrary PHP code.

Successful exploitation requires valid administrator credentials (see vulnerability #1).

The vulnerabilities are confirmed in version 2.5.3. Other versions may also be affected.

Solution
Restrict access to the "admin/options.php" script (e.g. with ".htaccess").
Further details available to Secunia VIM customers

Provided and/or discovered by
Gammarays

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://milw0rm.com/exploits/3725

Deep Links
Links available to Secunia VIM customers