CVE-2002-2298

CVE-2002-2298 describes a remote file inclusion vulnerability in Thatware versions 0.3 through 0.5.3, specifically within the config.php file. An attacker can exploit this by manipulating the 'root_path' parameter to execute arbitrary PHP code on the affected server. This vulnerability carries a CVSS score of 6.8, indicating a medium severity with a network-based attack vector, medium complexity, and potential for partial compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, public exploit code exists on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion or media coverage.