CVE-2002-0962
GeekLog < 1.3.5 - Cross-Site Scripting via Calendar Event Link, Topic Parameter, or Comment Title
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2002-0962. PoCs published by Ahmet Sabri ALPER.
AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in Geeklog by injecting malicious script code into URL parameters, which can steal cookie-based authentication credentials.
Description
Cross-site scripting vulnerabilities in GeekLog 1.3.5 and earlier allow remote attackers to execute arbitrary script via (1) the url variable in the Link field of a calendar event, (2) the topic parameter in index.php, or (3) the title parameter in comment.php.
Exploits (2)
This exploit demonstrates a cross-site scripting (XSS) vulnerability in Geeklog by injecting malicious script code into URL parameters, which can steal cookie-based authentication credentials.
The provided text describes a cross-site scripting (XSS) vulnerability in Geeklog due to insufficient sanitization of script code in form fields. It includes an example payload demonstrating how attacker-supplied script code could be executed in the context of the website.