CVE-2002-0902
PHPBB2 - Image Tag HTML Injection
Severity Score
7.5
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
2
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Cross-site scripting vulnerability in phpBB 2.0.0 (phpBB2) allows remote attackers to execute Javascript as other phpBB users by including a http:// and a double-quote (") in the [IMG] tag, which bypasses phpBB's security check, terminates the src parameter of the resulting HTML IMG tag, and injects the script.
Vulnerabilidad de secuencias de comandos en sitios cruzados en phpBB 2.0.0 (phpBB) permite a atacantes remotos ejecutar Javascript como otros usuarios de phpBB incluyendo http:// y comillas dobles ("") en una etiquieta IMG, lo que evade la comprobación de seguridad de phpBB, termina el parámetro src de la etiqueta HTML IMG, e injecta la secuencia de comandos.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2002-05-26 First Exploit
- 2002-08-16 CVE Reserved
- 2002-08-31 CVE Published
- 2024-01-09 EPSS Updated
- 2024-08-08 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| http://online.securityfocus.com/archive/1/274273 | Mailing List |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/21486 | 2002-05-26 | |
| http://www.securityfocus.com/bid/4858 | 2024-08-08 |
| URL | Date | SRC |
|---|---|---|
| http://www.iss.net/security_center/static/9178.php | 2008-09-05 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 2.0.0 Search vendor "Phpbb Group" for product "Phpbb" and version "2.0.0" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 2.0_beta1 Search vendor "Phpbb Group" for product "Phpbb" and version "2.0_beta1" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 2.0_rc1 Search vendor "Phpbb Group" for product "Phpbb" and version "2.0_rc1" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 2.0_rc2 Search vendor "Phpbb Group" for product "Phpbb" and version "2.0_rc2" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 2.0_rc3 Search vendor "Phpbb Group" for product "Phpbb" and version "2.0_rc3" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 2.0_rc4 Search vendor "Phpbb Group" for product "Phpbb" and version "2.0_rc4" | - |
Affected
| ||||||