Info

Last Modified

6 months ago

Percent Complete

50%

Disclosure

Jul 31, 2007

Discovery

Unknown

Dates

Exploit

Jul 31, 2007

Solution

Unknown

This Entry needs help! It is only 50% Complete. Click the edit link above to add more information.

Contributing is fast and easy, and benefits the entire security community.

Description

WebEvent contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'cmd' variable upon submission to the 'webevent.cgi' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

Classification

Location: Remote/Network Access Required
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Solution Unknown
Exploit: Exploit Available
OSVDB: Web Related

Products

Unknown or Incomplete

References

Bugtraq ID: 25148
Other Advisory URL: http://downloads.securityfocus.com/vulnerabilities/exploits/25148.html
CVE ID: 2007-4146 (see also: NVD)

Manual Testing Notes

Credit

Unknown or Incomplete

Blogs

Provided by Technorati

2007/08/03 00:00:00 | CVE-2007-4146

from: National Vulnerability Database

CVE-2007-4146 Publish Date: 8/3/2007 Cross-site scripting (XSS) vulnerability in webevent.cgi in WebEvent 2.61 through 4.03 allows remote attackers to inject arbitrary web script or HTML via

Views This Week

Views All Time