CVE-2002-0840

Apache HTTP Server < 2.0.43 and 1.3.x <= 1.3.26 - Cross-Site Scripting via Host Header

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2002-0840. PoCs published by mattmurphy.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in Apache's SSI error pages by injecting malicious HTML/script code via a crafted URL. The attack executes arbitrary JavaScript in the context of the victim's browser when visiting the malicious link.

Description

Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.

Exploits (1)

exploitdb WORKING POC VERIFIED

by mattmurphy · textremotemultiple

https://www.exploit-db.com/exploits/21885

View Code ZIP pw:eip

This exploit demonstrates a cross-site scripting (XSS) vulnerability in Apache's SSI error pages by injecting malicious HTML/script code via a crafted URL. The attack executes arbitrary JavaScript in the context of the victim's browser when visiting the malicious link.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: Apache HTTP Server (versions affected by CVE-2002-0840)

No auth needed

Prerequisites: Victim must visit the crafted URL · Apache server with vulnerable SSI error page handling

MITRE ATT&CK

T1059.007 - JavaScript

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (37)

Core 37

Core References

Various Sources vendor-advisory x_refsource_engarde

http://www.linuxsecurity.com/advisories/other_advisory-2414.html

Third Party Advisory, VDB Entry vendor-advisory x_refsource_hp

http://online.securityfocus.com/advisories/4617

Vendor Advisory x_refsource_confirm

http://www.apacheweek.com/issues/02-10-04

Various Sources vendor-advisory x_refsource_mandrake

http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-068.php

Vendor Advisory vendor-advisory x_refsource_conectiva

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000530

Third Party Advisory mailing-list x_refsource_bugtraq

http://archives.neohapsis.com/archives/bugtraq/2002-10/0254.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2002-243.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://www.osvdb.org/862

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2002-222.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2003-106.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2002-251.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/10241

Third Party Advisory mailing-list x_refsource_vulnwatch

http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0003.html

US Government Resource third-party-advisory x_refsource_cert-vn

http://www.kb.cert.org/vuls/id/240329

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2002-248.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2002-244.html

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2002/dsa-188

Mailing List x_refsource_confirm

http://marc.info/?l=apache-httpd-announce&m=103367938230488&w=2

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2002/dsa-187

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2002/dsa-195

Mailing List mailing-list x_refsource_bugtraq

http://marc.info/?l=bugtraq&m=103376585508776&w=2

Mailing List mailing-list x_refsource_bugtraq

http://marc.info/?l=bugtraq&m=103357160425708&w=2

Vendor Advisory vendor-advisory x_refsource_sgi

ftp://patches.sgi.com/support/free/security/advisories/20021105-02-I

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/5847