PT-2002-2671 · Phprank · Phprank

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-1950

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpRank version 1.8

Description The issue is related to a cross-site scripting (XSS) vulnerability. This allows remote attackers to inject arbitrary web script or HTML. Specifically, the vulnerability can be exploited through the email parameter of "add.php" or the banurl parameter, which is the banner URL in the main list.

Recommendations For phpRank version 1.8, as a temporary workaround, consider validating and sanitizing user input for the email parameter in "add.php" and the banurl parameter to prevent malicious script injections. Restrict access to "add.php" and limit the ability to set the banner URL to trusted users until a fix is available.

Exploit

Fix

Related Identifiers

CVE-2002-1950

Affected Products

Phprank

References · 4

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2002-10/0148.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-1950 · Security Note
• http://iss.net/security_center/static/10351.php · Note
• http://securityfocus.com/bid/5946 · Note