CVE-2002-1757

PHProjekt 2.0 through 3.1 relies on the $PHP_SELF variable for authentication, which allows remote attackers to bypass authentication for scripts via a request to a .php file with "sms" in the URL, which is included in the PATH_INFO portion of the $PHP_SELF variable, as demonstrated using "mail_send.php/sms".

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

3.14% chance of exploitation in the next 30 days, 87th percentile

Published

2005-06-21

Updated

2024-08-08

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/21421

References

• CVE Record
• NVD entry

Related

• CVE-2002-1744
• CVE-2002-1762
• CVE-2002-1741
• CVE-2002-1766
• CVE-2002-1740
• CVE-2002-1767