SECUNIA ADVISORY ID: SA22782

VERIFY ADVISORY: http://secunia.com/advisories/22782/

CRITICAL: Moderately critical

IMPACT: Exposure of sensitive information

WHERE: >From remote

SOFTWARE: phpMyChat Plus 1.x - http://secunia.com/product/12556/

DESCRIPTION: ajann has discovered several vulnerabilities in phpMyChat Plus, which can be exploited by malicious people to disclose potentially sensitive information. Input passed to the "ChatPath" parameter in colorhelp_popup.php and color_popup.php and the "L" parameter in avatar.php and logs.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources. Successful exploitation requires that "magic_quotes_gpc" is disabled. Successful exploitation of the colorhelp_popup.php script also requires that "register_globals" is enabled. The vulnerabilities are confirmed in version 1.90_fixed_060917. Other versions may also be affected.

SOLUTION: Edit the source code to ensure that input is properly verified.

PROVIDED AND/OR DISCOVERED BY: ajann