Remove duplicate entries (which differ on technique used to detect vulnerability)

[andresriancho]

Are 27 and 28 the same vulnerability?

[Zapotek]

From vulndb's point of view yeah, you can remove one of them.

[andresriancho]

@Zapotek well, this started as a comment to myself, but it's really good you've answered since now I can ask a couple of follow-up questions 👍

I believe we'll have a small decision to make here. First let me ask: "Do you intend on using vulndb in Arachni?" If the answer is yes, then we'll have to find a way to handle these cases, one of course can be that arachni reports the same vulnerability (without the different title) in both cases, another is that the ruby-sdk allows you to override the title?

The same thing happens with other vulnerabilities like XSS where the json files are almost the same. In cases like this I'm unsure if the developer reading these descriptions benefits from:

    "in the server's response.\nFor example", 
    "`HTTP://yoursite.com/INJECTION_HERE/`, where `INJECTION_HERE`", 
    "represents the location where the the tool payload was injected."

vs.

    "content directly into an HTML\ntag. For example `<INJECTION_HERE", 
    "href=.......etc>` where `INJECTION_HERE`\nrepresents the location where", 
    "the the tool payload was detected."

I want you to use vulndb in Arachni, hell, I want every tool to use it, it's the only way to maintain and grow it! So... what should we do?

Referenced files

• Cross domain policy
  • https://github.com/vulndb/data/blob/master/db/27-insecure-cross-domain-policy-allow-access-from.json
  • https://github.com/vulndb/data/blob/master/db/28-insecure-cross-domain-policy-allow-http-request-headers-from.json
• XSS
  • https://github.com/vulndb/data/blob/master/db/60-cross-site-scripting-xss-in-path.json
  • https://github.com/vulndb/data/blob/master/db/61-cross-site-scripting-xss-in-script-context.json
  • https://github.com/vulndb/data/blob/master/db/62-cross-site-scripting-xss-in-html-tag.json

[Zapotek]

I think we should remove all those permutations (same goes for timing attacks etc) and only keep the data for the root issue.
Then tools will be able to get the generic descriptions etc. and append any extra stuff about the way they identified the vuln as needed.

And yeah I'd like to use vulndb in Arachni eventually.

[andresriancho]

Ok then, I'll keep this issue open so we remember to do it