|
Description
|
|
Multiple vulnerabilities have been identified in PCPIN Chat, which could be exploited by remote attackers to execute arbitrary commands.
The first flaw is due to an input validation error in the "main.php" script that does not properly validate the "login" variable before being used in SQL statements, which could be exploited by malicious people to conduct SQL injection attacks and gain unauthorized access to the administration interface where they can upload malicious images.
The second flaw is due to an input validation error in the "main.php" script that does not properly validate the "language" parameter, which could be exploited in combination with the first issue to include local files and execute arbitrary commands with the privileges of the web server.
|
