PT-2002-2076 · Phpwiki · Phpwiki Postnuke Wiki Module

Published 2002-08-31 · Updated 2008-09-05 · CVE-2002-1070

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: PHPWiki Postnuke wiki module (affected versions not specified)

Description: A cross-site scripting issue allows remote attackers to execute script as other PHPWiki users via the pagename parameter in the API endpoint.

Recommendations: For the PHPWiki Postnuke wiki module, consider restricting access to the pagename parameter to minimize the risk of exploitation. Avoid using the pagename parameter in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2002-1070

Affected Products

Phpwiki Postnuke Wiki Module

References · 5

• 🔥 https://exploit-db.com/exploits/21622 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-1070 · Security Note
• http://iss.net/security_center/static/9627.php · Vendor Advisory
• http://securityfocus.com/bid/5254 · Vendor Advisory
• http://archives.neohapsis.com/archives/bugtraq/2002-07/0190.html · Note