| Package | Affected versions | Patched versions |
|---|---|---|
| activecollab chat module | = 1.0= 1.1= 1.1.1= 1.2= 1.3= 1.3.2= 1.4= 1.4.1= 1.5= 1.5.1 |
functions/html_to_text.php in the Chat module before 1.5.2 for activeCollab allows remote authenticated users to execute arbitrary PHP code via the message[message_text] parameter to chat/add_messag, which is not properly handled when executing the preg_replace function with the eval switch.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free