CVE-2002-1917

CVE-2002-1917 describes a CRLF injection vulnerability in the "User Profile: Send Email" feature of Geeklog versions 1.35 and 1.3.5sr1. This flaw allows remote attackers to inject a CRLF into the email's Subject field, enabling them to add a BCC mail header and potentially obtain email addresses. The vulnerability has a CVSS score of 5.0, indicating a medium severity, with a network attack vector, low complexity, and a potential impact of partial confidentiality. There is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Despite the lack of exploit intelligence, the CVE has garnered significant community discussion with 10 mentions, placing it in the top 1% of all CVEs for community attention.