CVE-2007-1394

CRITICAL 10.0CVE-2007-1394 · Published 10/03/2007 · updated 16/06/2026

In short

CVE-2007-1394 is a CRITICAL (CVSS 10.0) vulnerability affecting flat chat (flat chat).
Chance of exploitation in the next 30 days (EPSS): 4.4%, higher than 91.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
flat chat flat_chat	`= 2.0`	No fix yet

Description

Direct static code injection vulnerability in startsession.php in Flat Chat 2.0 allows remote attackers to execute arbitrary PHP code via the Chat Name field, which is inserted into online.txt and included by users.php. NOTE: some of these details are obtained from third party information.

References

osvdb.org/33890
secunia.com/advisories/24433 · Exploit
securityfocus.com/bid/22865 · Exploit
vupen.com/english/advisories/2007/0871
exchange.xforce.ibmcloud.com/vulnerabilities/32882
exploit-db.com/exploits/3428

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free