Direct static code injection vulnerability in admin/save.php in Stephen Craton (aka…
Priority LOW 33Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
Direct static code injection vulnerability in admin/save.php in Stephen Craton (aka WiredPHP) Chatness 2.5.3 and earlier allows remote authenticated administrators to inject PHP code into .html files via the html parameter, as demonstrated by head.html and foot.html, which are included and executed upon a direct request for index.php. NOTE: a separate vulnerability could be leveraged to make this issue exploitable by remote unauthenticated attackers.
Why it matters now
EPSS 0.01991 80th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:stephen_craton:chatness:*:*:*:*:*:*:*:* | up to 2.5.3 | Vulnerable | Stephen Craton |
- cpe:2.3:a:stephen_craton:chatness:*:*:*:*:*:*:*:* Versions up to 2.5.3 Vulnerable ·Stephen Craton
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2007-2148
- 2026-10-03 Alias added: GHSA-r8q7-f3rm-89r8
References
Advisory 1
Other 1
More Stephen Craton Chatness vulnerabilities
- TI-2007-02068 admin/options.php in Stephen Craton (aka WiredPHP) Chatness 2.5.3 and earlier does not… CVSS 2.0HIGH 10.0
- TI-2007-02070 Stephen Craton (aka WiredPHP) Chatness 2.5.3 and earlier stores usernames and unencrypted… CVSS 2.0HIGH 10.0
Sources
- CVE-2007-2148 · CVE Program
- CVE-2007-2148 · NVD
- FIRST EPSS
- GHSA-r8q7-f3rm-89r8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences