SQL Injection in Reallysimplechat Really Simple Chat

CVE-2011-2181

Multiple SQL injection vulnerabilities in A Really Simple Chat (ARSC) 3.3-rc2 allow remote attackers to execute arbitrary SQL commands via the (1) arsc_user parameter to base/admin/edit_user.php, (2) arsc_layout_id parameter in base/admin/edit_layout.php, or (3) arsc_room parameter to base/admin/edit_room.php.

Vulnerability class: SQL Injection

EPSS: 0.011 (63.5th percentile) — read the EPSS interpretation.

Affected products

Reallysimplechat Really_simple_chat — versions 3.3
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

secalert@redhat.com (Exploit, x_refsource_MISC)
secalert@redhat.com (mailing-list, x_refsource_MLIST, Exploit)
secalert@redhat.com (mailing-list, x_refsource_MLIST, Exploit)