PT-2002-2352 · Mike Spice · Mike Spice Quiz Me!

Published 2002-12-31 · Updated 2017-07-11 · CVE-2002-1627

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mike Spice Quiz Me! versions prior to 0.6

Description The issue allows remote attackers to write arbitrary files due to a directory traversal vulnerability in the quiz.cgi component. This is achieved by using .. (dot dot) sequences in the quiz parameter.

Recommendations For versions prior to 0.6, update to version 0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the quiz.cgi component to minimize the risk of exploitation. Avoid using the quiz parameter with unvalidated input until the issue is resolved.

Fix

Related Identifiers

CVE-2002-1627

Affected Products

Mike Spice Quiz Me!

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2002-1627 · Security Note
• http://securityfocus.com/bid/3857 · Patch
• http://kb.cert.org/vuls/id/318835 · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7970 · Note
• http://securitytracker.com/id?1003254 · Note