CVE-2004-1648
Description
Cross-site scripting (XSS) vulnerability in (1) index.asp, (2) ChangePassword.asp, (3) users_list.asp, (4) and users_add.asp in Password Protect allows remote attackers to inject arbitrary web script or HTML via the ShowMsg parameter.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- cpe:2.3:a:web_animations:password_protect:*:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
Root cause
"The application does not sanitize or encode the ShowMsg query-string parameter before rendering it in the HTML output of multiple ASP pages."
Attack vector
An unauthenticated remote attacker can inject arbitrary HTML or JavaScript by crafting a URL that includes malicious code in the `ShowMsg` parameter of the affected scripts [ref_id=1]. For example, visiting `/adminSection/index.asp?ShowMsg=(XSS)` causes the unsanitized payload to be rendered in the victim's browser [ref_id=1]. No authentication or special network position is required; the attacker simply lures a victim (such as an administrator) into clicking the crafted link.
Affected code
The vulnerability exists in the ASP scripts `index.asp`, `ChangePassword.asp`, `users_list.asp`, and `users_add.asp` located in the `/adminSection/` directory of Password Protect [ref_id=1]. These files fail to filter or sanitize user-supplied input passed via the `ShowMsg` query-string parameter [ref_id=1].
What the fix does
The advisory does not include a patch or vendor-supplied fix [ref_id=1]. The vendor was contacted on 6 August 2004 but did not respond, and no updated version has been released to address the issue [ref_id=1]. To remediate, administrators must manually apply input validation and output encoding to the `ShowMsg` parameter in each of the four affected ASP files, ensuring that HTML special characters are escaped before being rendered.
Preconditions
- networkThe attacker must be able to send HTTP requests to the web application (no authentication required).
- inputThe victim (e.g., an administrator) must browse to a crafted URL containing the XSS payload in the ShowMsg parameter.
Reproduction
The advisory provides the following proof-of-concept examples [ref_id=1]: `/adminSection/index.asp?ShowMsg=(XSS)` `/adminSection/ChangePassword.asp?ShowMsg=(XSS)` `/adminSection/users_list.asp?ShowMsg=(XSS)` `/adminSection/users_add.asp?ShowMsg=(XSS)` Replace `(XSS)` with a JavaScript payload such as `
Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- secunia.com/advisories/12407nvdExploitVendor Advisory
- www.criolabs.net/advisories/passprotect.txtnvdExploitVendor AdvisoryURL Repurposed
- www.securityfocus.com/bid/11073nvdExploitVendor Advisory
- marc.infonvd
- exchange.xforce.ibmcloud.com/vulnerabilities/17187nvd
News mentions
0No linked articles in our index yet.