web-app.org WebAPP index.cgi cross-site scripting
| webapporg-index-xss (25435) |  Medium Risk |
Description:
web-app.org WebAPP is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the index.cgi script using various parameters or the calendar/index.cgi script using the vsSD parameter. A remote attacker could exploit this vulnerability to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Platforms Affected:
- WebAPP, web-app.org WebAPP 0.9.9.3.2 and prior
Remedy:
Apply the May 15 Security Patch for this vulnerability, available from the web-app.org WebAPP Web site. See References.
Consequences:
Gain Access
References:
- UNSECURED SYSTEMS 27 march 2006, WebAPP multiple XSS vuln. at http://pridels.blogspot.com/2006/03/webapp-multiple-xss-vuln.html.
- VIM Mailing List, Thu Jun 28 19:01:36 UTC 2007, Regarding Web-APP.org WebAPP CVE Entry Details at http://www.attrition.org/pipermail/vim/2007-June/001687.html.
- Web-APP.org Forums, 11/23/06 at 20:36:22 GMT, What Is New in Versions Since 0.9.9.1? at http://www.web-app.org/cgi-bin/index.cgi?action=forum&board=how_to&op=display&num=9458.
- web-app.org WebAPP Web site, May 15 Security Patch at http://www.web-app.org/cgi-bin/index.cgi?action=downloadinfo&cat=pastversions&id=7.
- BID-17359: Web-App.Org and Web-App.Net Multiple Cross-Site Scripting Vulnerabilities
- CVE-2006-1427: Multiple cross-site scripting (XSS) vulnerabilities in WebAPP 0.9.9.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) action, (2) id, (3) num, (4) board, (5) cat, (6) real, (7) viewcat, (8) img, or (9) curcatname parameter in cgi-bin/index.cgi, or (10) vsSD parameter in /mods/calendar/index.cgi.
- OSVDB ID: 24278: WebAPP index.cgi Multiple Variable XSS
- OSVDB ID: 24279: WebAPP mods/calendar/index.cgi vsSD Variable XSS
- SA19506: WebAPP Cross-Site Scripting Vulnerabilities
- VUPEN/ADV-2006-1102: WebAPP index.cgi Multiple Variable Handling Cross Site Scripting Vulnerabilities
Reported:
Mar 27, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net