Description
PHP-Charts v1.0 contains a PHP code execution vulnerability in wizard/url.php, where user-supplied GET parameter names are passed directly to eval() without sanitization. A remote attacker can exploit this flaw by crafting a request that injects arbitrary PHP code, resulting in command execution under the web server's context. The vulnerability allows unauthenticated attackers to execute system-level commands via base64-encoded payloads embedded in parameter names, leading to full compromise of the host system.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
PHP-Charts PHP-Charts
Default version status: unknown
1.0affected
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/php_charts_exec.rb ↗
- https://www.exploit-db.com/exploits/24201 ↗
- https://www.exploit-db.com/exploits/24273 ↗
- https://web.archive.org/web/20130120234844/http://php-charts.com/ ↗
- https://www.vulncheck.com/advisories/php-charts-php-code-execution ↗