CVE-2004-1589

Vulnerability

Cross-site scripting (XSS) vulnerability exists in GoSmart Message Board (version unspecified) due to insufficient input sanitization. The 'Category' parameter in Forum.asp and the 'MainMessageID' parameter in ReplyToQuestion.asp allow injection of arbitrary web script or HTML [1].

Exploitation

An unauthenticated remote attacker can craft a URL containing malicious script in the 'Category' or 'MainMessageID' parameter. By enticing a victim to visit such a URL (e.g., via email or a link), the attacker can execute arbitrary HTML and script in the victim's browser within the security context of the affected site [1].

Impact

Successful exploitation allows the attacker to execute arbitrary script in the victim's browser, potentially leading to session hijacking, cookie theft, defacement of the web page, or redirection to malicious sites. The impact is limited to the user's interaction with the application [1].

Mitigation

No official patch was released by GoSmart for this vulnerability. The application may be discontinued or end-of-life. Mitigation includes applying generic web application firewall rules to filter XSS patterns or upgrading to an alternative solution [1].