CVE-2002-2297: PHP remote file inclusion vulnerability in artlist.php in Thatware 0.5.2 and 0.5.3 allows remote attackers...

Security readout for executives and security teams

CVE-2002-2297 is an old remote file inclusion flaw in Thatware 0.5.2 and 0.5.3. If a vulnerable site is exposed, an attacker may be able to make it run attacker-controlled PHP code. The bundle does not name a patch, so legacy exposure should be treated as a retirement or vendor-guidance issue. Exposure is most likely limited to legacy PHP websites still running Thatware 0.5.2 or 0.5.3, especially if internet-facing and still serving artlist.php. Modern environments are unlikely to be affected unless old Thatware code was retained, forked, or embedded. Prioritize if any legacy Thatware instance is internet-facing. The business risk is full web application compromise, but the likely footprint is narrow and old. If no Thatware assets exist, document non-exposure and close. Mitigation focus: Inventory and retire any Thatware 0.5.2 or 0.5.3 installations.; Check original vendor or archive guidance for any available fixed release.; Remove public access to vulnerable Thatware code if replacement is not immediate..

Prepared

Jun 29, 2026, 02:29 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.