Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2002-1410: Easy Guestbook lets attackers delete entries or change settings
CVE-2002-1410 · published 23 years ago
Summary
The Easy Guestbook web program (ben_chivers_guestbook and easy_guestbook) does not verify that a user is an administrator before running admin.cgi or config.cgi. Because of this, anyone on the internet can erase guestbook posts or alter its configuration. Update to a version that requires a login for these files or block public access to them.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ben_chivers | ben_chivers_guestbook |
1.0 cpe:2.3:a:ben_chivers:ben_chivers_guestbook:1.0:*:*:*:*:*:*:* |
| easy_scripts_archive | easy_guestbook |
1.0 cpe:2.3:a:easy_scripts_archive:easy_guestbook:1.0:*:*:*:*:*:*:* |
Original advisory text
Easy Guestbook CGI programs do not authenticate the administrator, which allows remote attackers to (1) delete entries via direct access of admin.cgi, or (2) reconfigure Guestbook via direct access...
Easy Guestbook CGI programs do not authenticate the administrator, which allows remote attackers to (1) delete entries via direct access of admin.cgi, or (2) reconfigure Guestbook via direct access of config.cgi.
References
- http://archives.neohapsis.com/archives/bugtraq/2002-07/0356.html Exploit Patch Vendor Advisory
- http://www.iss.net/security_center/static/9697.php Vendor Advisory
- http://www.securityfocus.com/bid/5341 Exploit Patch Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
7.5
High
Timeline
Published11 Apr 2003
Updated30 Oct 2026
First seen29 Sep 2026
Sources
CVE-2002-1410 · NVD
Track software like this
Free during beta