GHSA-v4cp-2q7v-hg9q

livehelperchat Server-Side Template Injection

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-27516

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	remdex/livehelperchat	< 4.29	4.29

Details

As written in the advisory (Markdown source, shown as plain text).

Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhc_web/modules/lhfaq/faqweight.php.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-27516 advisory
https://github.com/LiveHelperChat/livehelperchat/issues/2054 web
https://github.com/LiveHelperChat/livehelperchat/commit/a61d231526a36d4a7d8cc957914799ee1f9db0ab web
https://github.com/LiveHelperChat/livehelperchat package