Cross site scripting

2006-03-2820:02:00

PRIOn knowledge base

www.prio-n.com

6.1 Medium

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.6%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in WebAPP 0.9.9.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) action, (2) id, (3) num, (4) board, (5) cat, (6) real, (7) viewcat, (8) img, or (9) curcatname parameter in cgi-bin/index.cgi, or (10) vsSD parameter in /mods/calendar/index.cgi.

CPENameOperatorVersion
webappeq0.9.9.3
webappeq0.9.9.3.2
webappeq0.9.9.2.1
webappeq0.9.9.2
webappeq0.9.9.1
webappeq0.9.9.3.1

Name	Operator	Version
webapp	eq	0.9.9.3
webapp	eq	0.9.9.3.2
webapp	eq	0.9.9.2.1
webapp	eq	0.9.9.2
webapp	eq	0.9.9.1
webapp	eq	0.9.9.3.1

References

secunia.com/advisories/19506

www.osvdb.org/24278

www.osvdb.org/24279

www.securityfocus.com/bid/17359

www.vupen.com/english/advisories/2006/1102

www.web-app.net/cgi-bin/index.cgi?action=downloadinfo&cat=pastversions&id=1

www.web-app.net/cgi-bin/index.cgi?action=redirectd&cat=pastversions&id=1

exchange.xforce.ibmcloud.com/vulnerabilities/25435

pridels0.blogspot.com/2006/03/webapp-multiple-xss-vuln.html