CVE-2014-8998

Name of the Vulnerable Software and Affected Versions X7 Chat versions 2.0.0 through 2.0.5.1

Description The issue allows remote authenticated users to execute arbitrary PHP code via a crafted HTTP header to "index.php", which is processed by the preg replace function with the eval switch. This can lead to code execution.

Recommendations For X7 Chat versions 2.0.0 through 2.0.5.1, consider disabling the preg replace function with the eval switch in the lib/message.php file until a patch is available. Restrict access to the index.php file to minimize the risk of exploitation. Avoid using the eval switch in the preg replace function to prevent arbitrary code execution.