CVE-2007-3423 | BDVDB-2026-24923 Detail

Description#

cgi-bin/cgi-lib/instantmessage.pl in web-app.org WebAPP before 0.9.9.7 uses the From field of an instant message as the beginning of the .dat file name when the (1) imview2 or (2) imview3 function reads (a) an internal IM, or a message from a (b) guest or (c) removed member, which has unknown impact and remote attack vectors.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.web-app.org/downloads/WebAPPv0.9.9.7.zip
http://www.web-app.org/cgi-bin/index.cgi?action=forum&board=how_to&op=display&num=9458
http://osvdb.org/45409

Exploit#

No public exploit known

History#

Version 12007-06-26Record published in the CVE List.
Version 22024-08-07Most recent update recorded in the CVE List.