CVE-2002-1070

php-wiki - Cross-Site Scripting via Pagename Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2002-1070. PoCs published by Pistone.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in PHP-Wiki by injecting malicious script code via the 'pagename' URI parameter. The vulnerability arises due to insufficient sanitization of HTML input, allowing arbitrary JavaScript execution in the context of the victim's browser.

Description

Cross-site scripting vulnerability in PHPWiki Postnuke wiki module allows remote attackers to execute script as other PHPWiki users via the pagename parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Pistone · textwebappsphp
https://www.exploit-db.com/exploits/21622

This exploit demonstrates a cross-site scripting (XSS) vulnerability in PHP-Wiki by injecting malicious script code via the 'pagename' URI parameter. The vulnerability arises due to insufficient sanitization of HTML input, allowing arbitrary JavaScript execution in the context of the victim's browser.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: PHP-Wiki (versions prior to fix for CVE-2002-1070)
No auth needed
Prerequisites: Victim must visit a crafted malicious link
MITRE ATT&CK
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Patch, Vendor Advisory vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/5254
Vendor Advisory vdb-entry x_refsource_xf
http://www.iss.net/security_center/static/9627.php
Third Party Advisory mailing-list x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2002-07/0190.html

Scores

EPSS 0.0278
EPSS Percentile 84.9%

Details

Status published
Products (6)
php-wiki/php-wiki 1.2
php-wiki/php-wiki 1.2.1
php-wiki/php-wiki 1.2.2
php-wiki/php-wiki 1.3.1
php-wiki/php-wiki 1.3.2
php-wiki/php-wiki 1.3.3
Published Oct 04, 2002
Tracked Since Feb 18, 2026