CVE-2002-2330 Cross-site scripting (XSS) vulnerability in stat.pl in StatsPlus 1.25 allows remote attackers to inject arbitrary web script or HTML via (1) HTTP_USER_AGENT or (2) HTTP_REFERER, which is written to st...
MediumCVSS 5.0
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in stat.pl in StatsPlus 1.25 allows remote attackers to inject arbitrary web script or HTML via (1) HTTP_USER_AGENT or (2) HTTP_REFERER, which is written to stats.html and executed in client browsers.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| uninet statsplus | = 1.25 | No fix listed |
References
- 20020725 Uninets StatsPlus 1.25 script injection vulnerabilities mailing-list
- statsplus-stat-script-injection(9678) vdb-entry
- 5316 vdb-entry