RCE in Cgiscript Cssearch Professional

CVE-2002-0495

csSearch.cgi in csSearch 2.3 and earlier allows remote attackers to execute arbitrary Perl code via the savesetup command and the setup parameter, which overwrites the setup.cgi configuration file that is loaded by csSearch.cgi.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.131 (96.0th percentile) — read the EPSS interpretation.

Affected products

Cgiscript Cssearch_professional
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

References

cve@mitre.org (Exploit, Patch, VDB Entry, Third Party Advisory, vdb-entry, Broken Link, x_refsource_BID, Vendor Advisory)
cve@mitre.org (Product, x_refsource_MISC)
cve@mitre.org (Patch, vdb-entry, Broken Link, Vendor Advisory, x_refsource_XF)
cve@mitre.org (Broken Link, Vendor Advisory, mailing-list, x_refsource_BUGTRAQ, VDB Entry, Third Party Advisory)