CVE-2012-6554

CVE-2012-6554 describes a remote PHP code injection vulnerability in the Chat module (before version 1.5.2) for activeCollab. An authenticated attacker can exploit this by injecting arbitrary PHP code into the message[message_text] parameter when adding a chat message, due to improper handling by the preg_replace function with the eval switch. This vulnerability has a CVSS score of 6.5, indicating a medium severity with low attack complexity, requiring authentication, and potentially leading to partial compromise of confidentiality, integrity, and availability. While not listed on the KEV catalog, exploit code is publicly available via a Metasploit module and ExploitDB, suggesting a high potential for exploitation, though there is no evidence of active exploitation or significant community discussion.