Exploitation Summary
EIP tracks 2 public exploits for CVE-2014-8998.
PoCs published by Metasploit, including Metasploit module exploits/multi/http/x7chat2_php_exec.
AI-analyzed exploit summary This Metasploit module exploits a post-authentication PHP code execution vulnerability in X7 Chat 2.0.0 to 2.0.5.1 via the `preg_replace()` function with the `/e` modifier in `lib/message.php`. It sends a crafted message containing malicious PHP code, which is executed when the message is accessed.
Description
lib/message.php in X7 Chat 2.0.0 through 2.0.5.1 allows remote authenticated users to execute arbitrary PHP code via a crafted HTTP header to index.php, which is processed by the preg_replace function with the eval switch.
Exploits (2)
This Metasploit module exploits a post-authentication PHP code execution vulnerability in X7 Chat 2.0.0 to 2.0.5.1 via the `preg_replace()` function with the `/e` modifier in `lib/message.php`. It sends a crafted message containing malicious PHP code, which is executed when the message is accessed.
This Metasploit module exploits a post-authentication PHP code execution vulnerability in X7 Chat 2.0.0 to 2.0.5.1 via the `preg_replace()` function with the `/e` modifier in `lib/message.php`. It leverages a crafted message containing a base64-encoded payload executed via HTTP header injection.