CVE-2006-1669

Severity: medium (CVSS 6.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-04-07 · updated 2026-06-16

Description

SQL injection vulnerability in chat/messagesL.php3 in phpHeaven Team PHPMyChat 0.14.5 and earlier allows remote attackers to execute arbitrary SQL commands via the T parameter. NOTE: this issue can be leveraged to execute arbitrary shell commands since the username is later processed in an eval() call, but since the username originated from the SQL injection, it could be a resultant issue.

Affected products

Phpheaven Phpmychat: through 0.14.5; 0.14.4

References

http://securitytracker.com/id?1015873
http://www.securityfocus.com/archive/1/430358/100/0/threaded
http://www.securityfocus.com/bid/17382
https://exchange.xforce.ibmcloud.com/vulnerabilities/25687
https://www.exploit-db.com/exploits/1646
http://securitytracker.com/id?1015873
http://www.securityfocus.com/archive/1/430358/100/0/threaded
http://www.securityfocus.com/bid/17382
https://exchange.xforce.ibmcloud.com/vulnerabilities/25687
https://www.exploit-db.com/exploits/1646

Get alerted when CVE-2006-1669 or the next vulnerability affects your stack