Cross-site scripting and information-disclosure vulnerabilities in WebBatch

vendor:

WebBatch

by:

Unknown

7.5

CVSS

HIGH

Cross-site scripting, Information-disclosure

CWE

Product Name: WebBatch

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: Unknown

Related CWE: Unknown

CPE: Unknown

Metasploit:

Other Scripts:

Platforms Tested: Unknown

Unknown

Cross-site scripting and information-disclosure vulnerabilities in WebBatch

WebBatch is prone to a cross-site scripting vulnerability and an information-disclosure vulnerability because it fails to adequately sanitize user-supplied input. An attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. The attacker may leverage the information-disclosure issue to obtain potentially sensitive information that could aid in further attacks.

Mitigation:

Ensure that user-supplied input is properly sanitized to prevent cross-site scripting and information-disclosure vulnerabilities. Regularly update the software to the latest version.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/25744/info
 
WebBatch is prone to a cross-site scripting vulnerability and an information-disclosure vulnerability because it fails to adequately sanitize user-supplied input.
 
An attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
The attacker may leverage the information-disclosure issue to obtain potentially sensitive information that could aid in further attacks.
 
Reports indicate that WebBatch 2007D is not affected by the cross-site scripting issue. 

http://www.example.com/webcgi/webbatch.exe?dumpinputdata