PT-2007-4690 · Webapp · Webapp

Published 2007-06-26 · Updated 2008-11-15 · CVE-2007-3419

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebAPP versions prior to 0.9.9.7

Description The issue concerns the editprofile3 function in cgi-bin/cgi-lib/user.pl, which fails to properly check several files, including themes.dat, languages.dat, profession.dat, gen.dat, marstat.dat, states.dat, and ages.dat, before saving member profile settings. This has an unknown impact and can be exploited remotely.

Recommendations For versions prior to 0.9.9.7, update to version 0.9.9.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the editprofile3 function in cgi-bin/cgi-lib/user.pl until a patch is available. Additionally, restrict modifications to the files themes.dat, languages.dat, profession.dat, gen.dat, marstat.dat, states.dat, and ages.dat to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-3419

Affected Products

Webapp

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2007-3419 · Security Note
• http://web-app.org/downloads/WebAPPv0.9.9.7.zip · Patch
• http://osvdb.org/45400 · Note
• http://web-app.org/cgi-bin/index.cgi?action=forum&board=how_to&op=display&num=9458 · Note