CVE-2014-8998

lib/message.php in X7 Chat 2.0.0 through 2.0.5.1 allows remote authenticated users to execute arbitrary PHP code via a crafted HTTP header to index.php, which is processed by the preg_replace function with the eval switch.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:S/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 98%
VendorProductVersion
x7chatx7_chat
2.0.0
x7chatx7_chat
2.0.0:a1
x7chatx7_chat
2.0.0:a2
x7chatx7_chat
2.0.0:a3
x7chatx7_chat
2.0.0:b1
x7chatx7_chat
2.0.0:b2
x7chatx7_chat
2.0.1:a1
x7chatx7_chat
2.0.2
x7chatx7_chat
2.0.3
x7chatx7_chat
2.0.4
x7chatx7_chat
2.0.4.1
x7chatx7_chat
2.0.4.3
x7chatx7_chat
2.0.4.4
x7chatx7_chat
2.0.5
x7chatx7_chat
2.0.5.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/128964/X7-Chat-2.0.5-lib-message.php-preg_replace-PHP-Code-Execution.html
http://www.exploit-db.com/exploits/35183
http://www.securityfocus.com/bid/71014
https://exchange.xforce.ibmcloud.com/vulnerabilities/98513
http://packetstormsecurity.com/files/128964/X7-Chat-2.0.5-lib-message.php-preg_replace-PHP-Code-Execution.html
http://www.exploit-db.com/exploits/35183
http://www.securityfocus.com/bid/71014
https://exchange.xforce.ibmcloud.com/vulnerabilities/98513