CVEvulnerability

CVE-2002-0495

10.0 HIGH Published 2002-08-12 Modified 2026-06-16 Official page ↗

Status: Modified
Published: 2002-08-12
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 2.0 ([email protected]): 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses: CWE-94

Description

csSearch.cgi in csSearch 2.3 and earlier allows remote attackers to execute arbitrary Perl code via the savesetup command and the setup parameter, which overwrites the setup.cgi configuration file that is loaded by csSearch.cgi.

Affected configurations

• cgiscript cssearch professional (<= 2.3)

Weakness · CWE (1)

CWE-94 Improper Control of Generation of Code weakness

Referenced by CWE · observed example (2)

CWE-94 Improper Control of Generation of Code weakness
CWE-96 Improper Neutralization of Directives in Statically Saved Code weakness

References

http://www.cgiscript.net/cgi-script/csNews/csNews.cgi?database=cgi.db&command=viewone&id=7 Product
http://www.iss.net/security_center/static/8636.php Broken Link, Patch, Vendor Advisory
http://www.securityfocus.com/archive/1/264169 Broken Link, Third Party Advisory, VDB Entry, Vendor Advisory
http://www.securityfocus.com/bid/4368 Broken Link, Exploit, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
http://www.cgiscript.net/cgi-script/csNews/csNews.cgi?database=cgi.db&command=viewone&id=7 Product
http://www.iss.net/security_center/static/8636.php Broken Link, Patch, Vendor Advisory
http://www.securityfocus.com/archive/1/264169 Broken Link, Third Party Advisory, VDB Entry, Vendor Advisory
http://www.securityfocus.com/bid/4368 Broken Link, Exploit, Patch, Third Party Advisory, VDB Entry, Vendor Advisory