CVE-2014-8998

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 35.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-11-20 · updated 2026-06-17
Weakness: CWE-94

Description

lib/message.php in X7 Chat 2.0.0 through 2.0.5.1 allows remote authenticated users to execute arbitrary PHP code via a crafted HTTP header to index.php, which is processed by the preg_replace function with the eval switch.

Affected products

X7Chat X7 Chat: 2.0.0, 2.0.0-a1, 2.0.0-a2, 2.0.0-a3, 2.0.0-b1, 2.0.0-b2 (+9)

References

http://packetstormsecurity.com/files/128964/X7-Chat-2.0.5-lib-message.php-preg_replace-PHP-Code-Execution.html
http://www.exploit-db.com/exploits/35183
http://www.securityfocus.com/bid/71014
https://exchange.xforce.ibmcloud.com/vulnerabilities/98513
http://packetstormsecurity.com/files/128964/X7-Chat-2.0.5-lib-message.php-preg_replace-PHP-Code-Execution.html
http://www.exploit-db.com/exploits/35183
http://www.securityfocus.com/bid/71014
https://exchange.xforce.ibmcloud.com/vulnerabilities/98513

Get alerted when CVE-2014-8998 or the next vulnerability affects your stack