CVE-2003-1187

phpkit 1.6.02-1.6.03 - Cross-Site Scripting via contact_email Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2003-1187. PoCs published by [email protected].

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in PHPKIT's 'include.php' script due to insufficient sanitization of URI parameters. The PoC shows how an attacker can inject malicious JavaScript via the 'contact_email' parameter.

Description

Cross-site scripting (XSS) vulnerability in include.php in PHPKIT 1.6.02 and 1.6.03 allows remote attackers to inject arbitrary web script or HTML via the contact_email parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED
by [email protected] · textwebappsphp
https://www.exploit-db.com/exploits/23333

This exploit demonstrates a cross-site scripting (XSS) vulnerability in PHPKIT's 'include.php' script due to insufficient sanitization of URI parameters. The PoC shows how an attacker can inject malicious JavaScript via the 'contact_email' parameter.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: PHPKIT (version not specified)
No auth needed
Prerequisites: Victim must follow a malicious link
MITRE ATT&CK
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/13590
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/8960
Vendor Advisory mailing-list x_refsource_fulldisc
http://lists.grok.org.uk/pipermail/full-disclosure/2003-November/013139.html
Exploit, Vendor Advisory, URL Repurposed x_refsource_misc
http://badwebmasters.net/advisory/017/

Scores

EPSS 0.0422
EPSS Percentile 90.0%

Details

Status published
Products (2)
phpkit/phpkit 1.6.02
phpkit/phpkit 1.6.03
Published Nov 02, 2003
Tracked Since Feb 18, 2026