PT-2002-3136 · Php · Php

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-2424

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP(Reactor) version 1.2.7 pl1

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via Javascript in the style attribute of an HTML tag.

Recommendations For PHP(Reactor) version 1.2.7 pl1, consider disabling the use of Javascript in the style attribute of HTML tags until a patch is available. Restrict access to potentially vulnerable web pages to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2002-2424

Affected Products

Php

References · 5

• 🔥 https://exploit-db.com/exploits/21755 · Exploit
• 🔥 http://securityfocus.com/bid/5569 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-2424 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2002-08/0262.html · Note
• http://iss.net/security_center/static/9958.php · Note