Unscored severity · published Dec 31, 2002
CVE-2002-2391
SQL injection vulnerability in index.php of WebChat 1.5 included in XOOPS 1.0 allows remote attackers to execute arbitrary SQL commands via the roomid parameter
–
CVSS
1.2%
EPSS
No
On KEV
Description
SQL injection vulnerability in index.php of WebChat 1.5 included in XOOPS 1.0 allows remote attackers to execute arbitrary SQL commands via the roomid parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Webchat · Webchat.org
1.5 · source: NVD
XO
Xoops · Xoops
1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-2391
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-2391
Exploit
http://archives.neohapsis.com/archives/bugtraq/2002-11/0136.html
cert.uni-stuttgart.de
http://cert.uni-stuttgart.de/archive/bugtraq/2002/11/msg00258.html
Patch
http://www.iss.net/security_center/static/10606.php
www.securityfocus.com
http://www.securityfocus.com/bid/6165
More from Webchat
–
CVE-2007-0485
PHP remote file inclusion vulnerability in defines.php in WebChat 0.77 allows remote attackers to execute arbitrary PHP code via a URL in the WEBCHATPATH parameter