CVE-2002-1702
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PHP Classifieds是一款基于WEB的PHP编写的目录分类程序。 PHP Classifieds对用户提交给的参数缺少正确充分的过滤，远程攻击者可以利用这个漏洞进行跨站脚本执行攻击。 PHP Classifieds包含的latestwap.php脚本中的URL参数对用户提交的数据缺少过滤，攻击者可以构建包含恶意代码URL参数的链接，当用户查看此链接时，包含的恶意脚本代码就会在用户浏览器行执行，导致用户基于Cookie认证的信息泄露。
Public Exploits 1
ExploitDB · 1
EDB-21552 [webapps]
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2002-1702
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Cross-site scripting vulnerability (XSS) in DeltaScripts PHP Classifieds 6.0.5 allows remote attackers to execute arbitrary script as other users via the URL parameter.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
PHP Classifieds跨站脚本执行漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PHP Classifieds是一款基于WEB的PHP编写的目录分类程序。 PHP Classifieds对用户提交给的参数缺少正确充分的过滤，远程攻击者可以利用这个漏洞进行跨站脚本执行攻击。 PHP Classifieds包含的latestwap.php脚本中的URL参数对用户提交的数据缺少过滤，攻击者可以构建包含恶意代码URL参数的链接，当用户查看此链接时，包含的恶意脚本代码就会在用户浏览器行执行，导致用户基于Cookie认证的信息泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2002-1702
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2002-1702
请登录查看更多情报信息。
Vendor Advisories for CVE-2002-1702 (2)
Other References for CVE-2002-1702 (1)
Same Patch Batch · n/a · 2005-06-21 · 163 CVEs total
| CVE-2002-1754 | Novell NetWare Client缓冲区溢出漏洞 | |
| CVE-2002-1744 | Microsoft IIS示例脚本CodeBrws.asp远程读取特定脚本源码漏洞 | |
| CVE-2002-1745 | Microsoft IIS CodeBrws.ASP检查文件扩展名不当漏洞 | |
| CVE-2002-1746 | Vtun漏洞 | |
| CVE-2002-1747 | Vtun数据安全受到威胁 | |
| CVE-2002-1748 | Slashcode登录任意用户帐号漏洞 | |
| CVE-2002-1749 | Microsoft Windows 2000务器终端服务故障锁定终端漏洞 | |
| CVE-2002-1750 | CSGuestbook可远程执行任意命令漏洞 | |
| CVE-2002-1751 | CSLiveSupport远程执行任意命令漏洞 | |
| CVE-2002-1752 | CSChat-R-Box远程执行任意命令漏洞 | |
| CVE-2002-1753 | CSNews Professional远程执行任意命令漏洞 | |
| CVE-2002-1759 | PHPProjekt本地文件可读取漏洞 | |
| CVE-2002-1763 | Solaris 8 dtscreen认证可绕过漏洞 | |
| CVE-2002-1762 | Microsoft Baseline Security Analyzer报告文件明文存放漏洞 | |
| CVE-2002-1761 | PHProjekt目录遍历漏洞 | |
| CVE-2002-1760 | PHPProjekt可插入SQL命令漏洞 | |
| CVE-2002-1757 | PHPProjekt登录可绕过漏洞 | |
| CVE-2002-1755 | tinc 1.0pre3 和 1.0pre4 VPN数据漏洞 | |
| CVE-2002-1756 | ACD Systems ACDSee Photo Album文件描述缓冲区溢出漏洞 | |
| CVE-2002-1743 | Mirabilis ICQ .hpf本地拒绝服务攻击漏洞 |
Showing top 20 of 163 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2002-1702
No comments yet