CVE-2012-6554
A51dev Activecollab Chat Module - Improper Input Validation
Title source: ruleDescription
functions/html_to_text.php in the Chat module before 1.5.2 for activeCollab allows remote authenticated users to execute arbitrary PHP code via the message[message_text] parameter to chat/add_messag, which is not properly handled when executing the preg_replace function with the eval switch.
Exploits (2)
metasploit
WORKING POC
EXCELLENT
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/activecollab_chat.rb
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubyremotephp
https://www.exploit-db.com/exploits/18898
References (6)
Scores
EPSS
0.6269
EPSS Percentile
98.3%
Classification
CWE
CWE-20
Status
draft
Affected Products (10)
a51dev/activecollab_chat_module
a51dev/activecollab_chat_module
a51dev/activecollab_chat_module
a51dev/activecollab_chat_module
a51dev/activecollab_chat_module
a51dev/activecollab_chat_module
a51dev/activecollab_chat_module
a51dev/activecollab_chat_module
a51dev/activecollab_chat_module
a51dev/activecollab_chat_module
Timeline
Published
May 23, 2013
Tracked Since
Feb 18, 2026