PT-2007-4695 · Webapp · Webapp

Published 2007-06-26 · Updated 2008-11-15 · CVE-2007-3424

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebAPP versions prior to 0.9.9.7

Description The issue concerns the moveim function in the instantmessage.pl script, which uses the tocat parameter as a subdirectory name when moving an instant message. This has unknown impact and may be exploitable through remote attack vectors.

Recommendations For versions prior to 0.9.9.7, update to version 0.9.9.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the instantmessage.pl script to minimize the risk of exploitation. Avoid using the tocat parameter in the affected script until the issue is resolved.

Fix

Related Identifiers

CVE-2007-3424

Affected Products

Webapp

References · 4

• http://web-app.org/downloads/WebAPPv0.9.9.7.zip · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-3424 · Security Note
• http://osvdb.org/45410 · Note
• http://web-app.org/cgi-bin/index.cgi?action=forum&board=how_to&op=display&num=9458 · Note