BID:24714

WebApp.org and WebApp.net Multiple Input Validation Vulnerabilities

Info

WebApp.org and WebApp.net Multiple Input Validation Vulnerabilities

Bugtraq ID:	24714
Class:	Input Validation Error
CVE:	CVE-2006-7186 CVE-2006-7187 CVE-2006-7188 CVE-2006-7189 CVE-2006-7190
Remote:	Yes
Local:	No
Published:	Jun 29 2007 12:00AM
Updated:	Jul 03 2007 09:17PM
Credit:	Jos Brown from Web-App.org reported these issues.
Vulnerable:	Web-APP.org WebAPP 0.9.9 Web-APP.org WebAPP 0.9.8 Web-APP.org WebAPP 0.9.7 Web-APP.org WebAPP 0.9.5 Web-APP.org WebAPP 0.9.4 Web-APP.org WebAPP 0.9.3 Web-APP.org WebAPP 0.9.9.3 Web-APP.org WebAPP 0.9.9.2 Web-APP.org WebAPP 0.9.9.1 Web-APP.org WebAPP 0.9 Web-APP.org WebAPP 0.8 Web-APP.net Web-APP.net 0.9.9.3.4NE

Not Vulnerable:

Discussion

WebApp.org and WebApp.net Multiple Input Validation Vulnerabilities

WebAPP.org and WebAPP.net are prone to multiple input-validation vulnerabilities because the software fails to sufficiently sanitize user-supplied input.

An attacker can exploit these issues to obtain sensitive information, execute arbitrary script code in the context of the affected application, steal cookie-based authentication credentials, and control how the site is rendered to the user; other attacks are also possible.

Exploit / POC

WebApp.org and WebApp.net Multiple Input Validation Vulnerabilities

Attackers may exploit these issues through a browser.

Solution / Fix

WebApp.org and WebApp.net Multiple Input Validation Vulnerabilities

Solution:
The vendor released a fix to address some of these issues. Please see the references for more information.

Web-APP.org WebAPP 0.9.9.3