CVE-2002-2319

MySimpleNews - Remote Code Execution via users.php Parameter Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2002-2319. PoCs published by frog.

AI-analyzed exploit summary This exploit demonstrates a remote code execution vulnerability in MySimpleNews where PHP code can be injected via the LOGIN, DATA, or MESS parameters in users.php, stored in news.php3, and executed by accessing news.php3.

Description

Static code injection vulnerability in users.php in MySimpleNews allows remote attackers to inject arbitrary PHP code and HTML via the (1) LOGIN, (2) DATA, and (3) MESS parameters, which are inserted into news.php3.

Exploits (1)

exploitdb WORKING POC VERIFIED
by frog · textwebappsphp
https://www.exploit-db.com/exploits/21900

This exploit demonstrates a remote code execution vulnerability in MySimpleNews where PHP code can be injected via the LOGIN, DATA, or MESS parameters in users.php, stored in news.php3, and executed by accessing news.php3.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: MySimpleNews (version not specified)
No auth needed
Prerequisites: Access to the target web application
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Third Party Advisory vdb-entry x_refsource_xf
http://www.iss.net/security_center/static/10296.php
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/5865
Exploit mailing-list x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2002-10/0027.html

Scores

EPSS 0.0225
EPSS Percentile 80.6%

Details

CWE
CWE-94
Status published
Products (1)
mysimplenews/mysimplenews 1.0
Published Dec 31, 2002
Tracked Since Feb 18, 2026