CVE-2003-1145 in OpenAutoClassifieds
Summary
by MITRE
Cross-site scripting (XSS) vulnerability in friendmail.php in OpenAutoClassifieds 1.0 allows remote attackers to inject arbitrary web script or HTML via the listing parameter.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/17/2025
The vulnerability identified as CVE-2003-1145 represents a classic cross-site scripting flaw within the OpenAutoClassifieds 1.0 web application, specifically affecting the friendmail.php component. This issue arises from insufficient input validation and sanitization mechanisms that fail to properly process user-supplied data before incorporating it into web responses. The vulnerability is particularly concerning as it exists in a classifieds platform where users regularly interact with listing information, making the attack surface more expansive than typical applications.
The technical implementation of this vulnerability stems from the improper handling of the listing parameter within the friendmail.php script. When users submit data through this interface, the application fails to sanitize or encode the input before rendering it in the web page context. This allows malicious actors to inject arbitrary HTML or JavaScript code that executes within the victim's browser context when other users view the affected listings. The vulnerability is categorized as a stored XSS when the malicious content is permanently stored in the application's database and reflected when retrieved, or as a reflected XSS when the malicious payload is immediately reflected back to the user through a crafted URL or form submission.
From an operational perspective, this vulnerability presents significant risks to both end users and the platform administrators. Attackers can exploit this flaw to steal session cookies, redirect users to malicious websites, deface listings, or perform actions on behalf of authenticated users. The impact extends beyond simple data theft as it can enable more sophisticated attacks such as credential harvesting, session hijacking, or even privilege escalation within the application's user management system. Given that OpenAutoClassifieds is a classifieds platform, the potential for financial fraud and reputation damage is substantial.
The vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws in web applications, and maps to ATT&CK technique T1566.001 related to spearphishing with embedded attachments. Security professionals should note that this vulnerability represents a fundamental flaw in input validation practices that violates core web application security principles. The lack of proper output encoding and input sanitization demonstrates a failure to implement defense-in-depth measures that are essential for modern web applications.
Mitigation strategies for this vulnerability should include immediate implementation of proper input validation and output encoding mechanisms. All user-supplied data must be sanitized using established libraries and frameworks that properly escape HTML entities and JavaScript contexts. The application should implement Content Security Policy headers to limit the execution of inline scripts and restrict external resource loading. Additionally, regular security code reviews and automated vulnerability scanning should be conducted to identify similar issues throughout the codebase. Database-level input sanitization combined with proper parameterized queries can further reduce the risk of injection attacks. Organizations should also consider implementing web application firewalls and monitoring systems to detect and prevent exploitation attempts.