CVE-2012-6554

A51dev Activecollab Chat Module - Improper Input Validation

Title source: rule

Description

functions/html_to_text.php in the Chat module before 1.5.2 for activeCollab allows remote authenticated users to execute arbitrary PHP code via the message[message_text] parameter to chat/add_messag, which is not properly handled when executing the preg_replace function with the eval switch.

Exploits (2)

metasploit WORKING POC EXCELLENT
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/activecollab_chat.rb
exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotephp
https://www.exploit-db.com/exploits/18898

Scores

EPSS 0.6269
EPSS Percentile 98.3%

Classification

CWE
CWE-20
Status draft

Affected Products (10)

a51dev/activecollab_chat_module
a51dev/activecollab_chat_module
a51dev/activecollab_chat_module
a51dev/activecollab_chat_module
a51dev/activecollab_chat_module
a51dev/activecollab_chat_module
a51dev/activecollab_chat_module
a51dev/activecollab_chat_module
a51dev/activecollab_chat_module
a51dev/activecollab_chat_module

Timeline

Published May 23, 2013
Tracked Since Feb 18, 2026