This host is running MyChat Plus and is prone to multiple vulnerabilities.

Successful exploitation will allow attacker to cause SQL Injection attack, gain sensitive information about the database used by the web application or can cause arbitrary code execution inside the context of the web application. Impact Level: Application

Upgrade to version 1.94 or later, For updates refer to http://sourceforge.net/projects/phpmychat

The flaws are due to: - Improper sanitization of user supplied input through the 'CookieUsername' and 'CookieStatus' parameter in Cookie. - Improper sanitization of user supplied input through the 'pmc_password' parameter in a printable action to avatar.php.

phpMyChat Plus version 1.93

• http://www.exploit-db.com/exploits/17213/
• http://www.l33thackers.com/Thread-webapps-phpMyChat-Plus-1-93-Multiple-Vulnerabilities

---

Updated on 2017-03-28