PT-2002-2524 · Xoops · Xoops

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-1802

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Xoops version 1.0 RC3

Description The issue allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag when submitting news, which can lead to cross-site scripting (XSS).

Recommendations For Xoops version 1.0 RC3, consider disabling the submission of news that includes Javascript in IMG tags until a patch is available. Restrict access to news submission to minimize the risk of exploitation. Avoid using Javascript in IMG tags in the affected version to prevent potential XSS attacks.

Exploit

Fix

Related Identifiers

CVE-2002-1802

Affected Products

Xoops

References · 7

• 🔥 http://securityfocus.com/bid/5785 · Exploit
• 🔥 https://exploit-db.com/exploits/21829 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2002-09/0286.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-1802 · Security Note
• http://iss.net/security_center/static/10173.php · Patch
• http://securityfocus.com/archive/1/293161 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1802 · Note