DATABASE RESOURCES PRICING ABOUT US

{"id": "WEBAPP_0996.NASL", "vendorId": null, "type": "nessus", "bulletinFamily": "scanner", "title": "Webapp.org WebAPP < 0.9.9.6 Multiple Vulnerabilities", "description": "The version of WebAPP from webapp.org installed on the remote host is affected by multiple, as-yet unspecified issues that could be abused by a remote attacker to completely compromise the affected application.", "published": "2007-03-19T00:00:00", "modified": "2021-01-19T00:00:00", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"cvssV2": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "baseScore": 7.5}, "severity": "HIGH", "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "cvss3": {}, "href": "https://www.tenable.com/plugins/nessus/24864", "reporter": "This script is Copyright (C) 2007-2021 Tenable Network Security, Inc.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1259", "http://www.nessus.org/u?002d99e2", "http://www.nessus.org/u?85d8b8c8"], "cvelist": ["CVE-2007-1259"], "immutableFields": [], "lastseen": "2023-01-11T14:27:33", "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2007-1259"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:7338"]}], "rev": 4}, "score": {"value": 0.7, "vector": "NONE"}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2007-1259"]}, {"type": "nessus", "idList": ["WEBAPP_DETECT.NASL"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:7338"]}]}, "exploitation": null, "vulnersScore": 0.7}, "_state": {"dependencies": 1673447554, "score": 1673449353}, "_internal": {"score_hash": "2781dfab69f33ce6fc9fde7157fc93f3"}, "pluginID": "24864", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(24864);\n script_version(\"1.18\");\n\n script_cve_id(\"CVE-2007-1259\");\n script_bugtraq_id(22691);\n\n script_name(english:\"Webapp.org WebAPP < 0.9.9.6 Multiple Vulnerabilities\");\n script_summary(english:\"Checks for an XSS flaw in WebAPP\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote web server contains a Perl application that is affected by\nmultiple issues.\" );\n script_set_attribute(attribute:\"description\", value:\n\"The version of WebAPP from webapp.org installed on the remote host is\naffected by multiple, as-yet unspecified issues that could be abused\nby a remote attacker to completely compromise the affected\napplication.\" );\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?85d8b8c8\" );\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?002d99e2\" );\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to webapp.org WebAPP version 0.9.9.6 or later.\" );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No exploit is required\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);\n\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2007/03/19\");\n script_set_attribute(attribute:\"vuln_publication_date\", value: \"2007/02/22\");\n\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_end_attributes();\n\n\n script_category(ACT_ATTACK);\n script_family(english:\"CGI abuses\");\n\n script_copyright(english:\"This script is Copyright (C) 2007-2021 Tenable Network Security, Inc.\");\n\n script_dependencies(\"webapp_detect.nasl\", \"cross_site_scripting.nasl\");\n script_exclude_keys(\"Settings/disable_cgi_scanning\");\n script_require_ports(\"Services/www\", 80);\n\n exit(0);\n}\n\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"http.inc\");\ninclude(\"url_func.inc\");\n\n\nport = get_http_port(default:80);\nif (get_kb_item(\"www/\"+port+\"/generic_xss\")) exit(0);\n\n\nxss = string(\"'';!--\", '\"', \"<BODY ONLOAD=alert('\", SCRIPT_NAME, \"')>=&{()}\");\n\n\n# Test an install.\ninstall = get_kb_item(string(\"www/\", port, \"/webapp\"));\nif (isnull(install)) exit(0);\nmatches = eregmatch(string:install, pattern:\"^(.+) under (/.*)$\");\nif (!isnull(matches))\n{\n dir = matches[2];\n\n # Send a request to exploit an XSS flaw.\n referer = string(\"://\", get_host_name(), dir, \"/index.cgi\");\n if (get_port_transport(port) > ENCAPS_IP) referer = \"https\" + referer;\n else referer = \"http\" + referer;\n\n url = string(dir, \"/index.cgi?action=search\");\n postdata = string(\"pattern=\", urlencode(str:xss));\n r = http_send_recv3(method:\"POST\", item: url, port: port, data: postdata,\n add_headers: make_array( \"Referer\", referer, \n \t\t \t \"Content-Type\", \"application/x-www-form-urlencoded\"));\n if (isnull(r)) exit(0);\n res = r[2];\n\n # There's a problem if our exploit as the language.\n xss = str_replace(find:'\"', replace:\"&quot;\", string:xss);\n if (string('No matches found for <b>\"', xss, '\"</b>') >< res)\n {\n security_hole(port);\n set_kb_item(name: 'www/'+port+'/XSS', value: TRUE);\n exit(0);\n }\n}\n", "naslFamily": "CGI abuses", "cpe": [], "solution": "Upgrade to webapp.org WebAPP version 0.9.9.6 or later.", "nessusSeverity": "High", "cvssScoreSource": "", "vendor_cvss2": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "vendor_cvss3": {"score": null, "vector": null}, "vpr": {"risk factor": "Medium", "score": "5.9"}, "exploitAvailable": false, "exploitEase": "No exploit is required", "patchPublicationDate": null, "vulnerabilityPublicationDate": "2007-02-22T00:00:00", "exploitableWith": []}

{"cve": [{"lastseen": "2022-03-23T11:52:10", "description": "Multiple unspecified vulnerabilities in WebAPP before 0.9.9.6 have unknown impact and attack vectors.", "cvss3": {}, "published": "2007-03-03T20:19:00", "type": "cve", "title": "CVE-2007-1259", "cwe": ["NVD-CWE-noinfo"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1259"], "modified": "2011-09-01T04:00:00", "cpe": ["cpe:/a:web-app.org:webapp:0.9.9.1", "cpe:/a:web-app.org:webapp:0.9.9.5", "cpe:/a:web-app.org:webapp:0.9.9", "cpe:/a:web-app.org:webapp:0.9.9.3.2", "cpe:/a:web-app.org:webapp:0.9.9.4", "cpe:/a:web-app.org:webapp:0.9.9.3", "cpe:/a:web-app.org:webapp:0.9.9.2.1", "cpe:/a:web-app.org:webapp:0.9.9.2", "cpe:/a:web-app.org:webapp:0.9.9.3.1"], "id": "CVE-2007-1259", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1259", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:web-app.org:webapp:0.9.9.2:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.4:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.5:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9:*:*:*:*:*:*:*"]}], "securityvulns": [{"lastseen": "2021-06-08T18:52:45", "description": "PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.", "edition": 2, "cvss3": {}, "published": "2007-03-03T00:00:00", "type": "securityvulns", "title": "Daily web applications security vulnerabilities summary &#40;PHP, ASP, JSP, CGI, Perl&#41;", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": true, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": true, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1183", "CVE-2007-1185", "CVE-2007-1188", "CVE-2007-1179", "CVE-2007-1152", "CVE-2007-1277", "CVE-2007-1187", "CVE-2007-1289", "CVE-2007-1184", "CVE-2007-1180", "CVE-2007-1134", "CVE-2007-1175", "CVE-2007-1181", "CVE-2007-1135", "CVE-2007-1192", "CVE-2007-1177", "CVE-2007-1291", "CVE-2007-1186", "CVE-2007-1136", "CVE-2007-1176", "CVE-2007-1259", "CVE-2007-1159", "CVE-2007-1178", "CVE-2007-1197", "CVE-2007-1290", "CVE-2007-1328", "CVE-2007-1193", "CVE-2007-1174", "CVE-2007-1182"], "modified": "2007-03-03T00:00:00", "id": "SECURITYVULNS:VULN:7338", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:7338", "sourceData": "", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}