Web-APP.Org WebAPP Directory Traversal Vulnerability

Bugtraq ID:	11028
Class:	Input Validation Error
CVE:	CVE-2004-1742
Remote:	Yes
Local:	No
Published:	Aug 24 2004 12:00AM
Updated:	Jul 03 2007 07:47PM
Credit:	"Jérôme" ATHIAS <[email protected]> disclosed this vulnerability.
Vulnerable:	Web-APP.org WebAPP 0.9.8 Web-APP.org WebAPP 0.9.7 Web-APP.org WebAPP 0.9.5 Web-APP.org WebAPP 0.9.4 Web-APP.org WebAPP 0.9.3 Web-APP.org WebAPP 0.9.9.1 Web-APP.org WebAPP 0.9 Web-APP.org WebAPP 0.8
Not Vulnerable:	Web-APP.org WebAPP 0.9.9.7 Web-APP.org WebAPP 0.9.9.2

Web-APP.Org WebAPP Directory Traversal Vulnerability

WebAPP is reported prone to a directory-traversal vulnerability because the application fails to properly sanitize user-supplied input data.

An attacker can exploit this vulnerability to retrieve arbitrary, potentially sensitive files from the hosting computer with the privileges of the webserver. gthe attacker could trivially retrieve DES-encrypted password hashes for all users of the application. This may aid the attacker in further attacks.

Web-APP.Org WebAPP Directory Traversal Vulnerability

Exploit code is not required. An example URI sufficient to exploit this vulnerability was provided:

http://www.example.com/cgi-bin/index.cgi?action=topics&viewcat=../../db/members/admin.dat%00

Web-APP.Org WebAPP Directory Traversal Vulnerability

Solution:
The vendor released an update to address this issue. Please see the references for more information.

Web-APP.Org WebAPP Directory Traversal Vulnerability

References:

• Web-app.org WebAPP Home Page (Web-app.org)
  
• WebAPP directory traversal and ability to retrieve the DES encrypted password ha ("Jérôme" ATHIAS )