CVE-2002-0922 CGIScript.net csNews.cgi allows remote attackers to obtain database files via a direct URL-encoded request to (1) default%2edb or (2) default%2edb.style, or remote authenticated users to perform admin...
MediumCVSS 5.0
EPSS 3.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
CGIScript.net csNews.cgi allows remote attackers to obtain database files via a direct URL-encoded request to (1) default%2edb or (2) default%2edb.style, or remote authenticated users to perform administrative actions via (3) a database parameter set to default%2edb.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cgiscript.net csnews | = 1.0 | No fix listed |
| cgiscript.net csnews | = 1.0_professional | No fix listed |
References
- 20020611 CGIscript.net - csNews.cgi - Multiple Vulnerabilities mailing-list
- cgiscript-csnews-file-disclosure(9332) vdb-entry vendor-advisory
- cgiscript-csnews-admin-access(9333) vdb-entry vendor-advisory
- 4991 vdb-entry vendor-advisory
- 4993 exploit vdb-entry vendor-advisory