CVE-2002-0923

CGIScript.net csNews.cgi - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2002-0923. PoCs published by Steve Gustin.

AI-analyzed exploit summary This is a writeup describing a vulnerability in csNews where an admin user can bypass file type restrictions to disclose sensitive system files. The provided JavaScript snippet demonstrates how to manipulate the file path to access 'setup.cgi'.

Description

CGIScript.net csNews.cgi allows remote authenticated users to read arbitrary files, and possibly gain privileges, via the (1) pheader or (2) pfooter parameters in the "Advanced Settings" capability.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Steve Gustin · textwebappscgi
https://www.exploit-db.com/exploits/21533

This is a writeup describing a vulnerability in csNews where an admin user can bypass file type restrictions to disclose sensitive system files. The provided JavaScript snippet demonstrates how to manipulate the file path to access 'setup.cgi'.

Classification
Writeup 80%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Theoretical
Target: csNews (version not specified)
Auth required
Prerequisites: Admin access to csNews · Public access if combined with other vulnerabilities (BID 4993)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Vendor Advisory vdb-entry x_refsource_xf
http://www.iss.net/security_center/static/9333.php
Exploit, Vendor Advisory vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/4994
Third Party Advisory mailing-list x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2002-06/0091.html

Scores

EPSS 0.0698
EPSS Percentile 93.3%

Details

Status published
Products (2)
cgiscript.net/csnews 1.0
cgiscript.net/csnews 1.0_professional
Published Oct 04, 2002
Tracked Since Feb 18, 2026