Executive brief
uBidAuction, a web-based auction management platform, contains a security flaw that allows attackers to run malicious scripts in a user's browser. By tricking a user into clicking a specially crafted link, an attacker could steal login sessions, redirect users to fraudulent websites, or capture sensitive information. This issue affects various parts of the application, including auction filters and order management pages.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in uBidAuction v2.0.1 due to improper neutralization of input during web page generation. The vulnerability is located within the filter functionality across several modules, including /orders/myOrders, /auctions/myAuctions, and /backend/mailingLog/manage. Specifically, the parameters 'date_created', 'date_from', 'date_to', and 'created_at' fail to sanitize user input before reflecting it in the HTML response. A remote attacker can exploit this by sending a crafted GET request to a victim. Successful exploitation allows for session hijacking, non-persistent phishing, or unauthorized redirection. The vulnerability was reported in early 2022, but official patch status for version 2.0.1 should be verified with the vendor.
Affected products
- ApPHP uBidAuction 2.0.1
Timeline
- 2022-01-21: disclosed: Initial public disclosure by Vulnerability Laboratory
- 2022-09-02: other: Vendor notification
- 2026-05-10: advisory: NVD publication date