PT-2002-3103 · Xoops+1 · Xoops+1

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-2391

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebChat version 1.5 XOOPS version 1.0

Description The issue allows remote attackers to execute arbitrary SQL commands via the roomid parameter in the "index.php" file of WebChat.

Recommendations For WebChat version 1.5, avoid using the roomid parameter in the affected API endpoint until the issue is resolved. For XOOPS version 1.0, restrict access to the vulnerable WebChat module to minimize the risk of exploitation.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2002-2391

Affected Products

Wechat

Xoops

References · 6

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2002-11/0136.html · Exploit
• http://iss.net/security_center/static/10606.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2002-2391 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2391 · Note
• http://cert.uni-stuttgart.de/archive/bugtraq/2002/11/msg00258.html · Note
• http://securityfocus.com/bid/6165 · Note