CVE-2002-0187

Microsoft SQL Server 2000 - Cross-Site Scripting via XML SQL Query Root Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2002-0187. PoCs published by Matt Moore.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in SQLXML HTTP components of SQL Server 2000. It injects arbitrary script code via XML tags, which executes in the context of the Internet Explorer Security Zone associated with the IIS server.

Description

Cross-site scripting vulnerability in the SQLXML component of Microsoft SQL Server 2000 allows an attacker to execute arbitrary script via the root parameter as part of an XML SQL query, aka "Script Injection via XML Tag."

Exploits (1)

exploitdb WORKING POC VERIFIED

by Matt Moore · textremotewindows

https://www.exploit-db.com/exploits/21541

View Code ZIP pw:eip

This exploit demonstrates a cross-site scripting (XSS) vulnerability in SQLXML HTTP components of SQL Server 2000. It injects arbitrary script code via XML tags, which executes in the context of the Internet Explorer Security Zone associated with the IIS server.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Moderate

Reliability

Reliable

Target: Microsoft SQL Server 2000 with SQLXML HTTP components

Auth required

Prerequisites: Access to an IIS server running vulnerable SQLXML HTTP components · Sufficient privileges to pass queries to the underlying SQL server · Knowledge of the virtual directory set up on the IIS server for SQLXML HTTP components

devstral-2 · analyzed Feb 16, 2026 Full analysis →