Executive brief
uBidAuction, a web-based auction management platform, contains a security flaw that allows attackers to run malicious scripts in a user's browser. By tricking a user into clicking a specially crafted link, an attacker could steal login sessions, redirect users to fraudulent websites, or capture sensitive information. This issue affects several parts of the application, including order management and auction filters.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in uBidAuction v2.0.1 due to improper neutralization of user-supplied input in the 'filter' module. Specifically, the parameters 'date_created', 'date_from', 'date_to', and 'created_at' are not properly sanitized before being rendered in the web page. A remote attacker can exploit this by sending a crafted GET request containing malicious JavaScript to a victim. Successful exploitation allows for session hijacking, client-side redirection, or phishing attacks. The vulnerability affects multiple endpoints including /news/manage, /orders/myOrders, and /auctions/manage.
Affected products
- ApPHP uBidAuction 2.0.1
- ApPHP MVC Framework 1.2.2
Timeline
- 2022-01-21: disclosed: Public disclosure by Vulnerability Laboratory
- 2022-09-02: other: Vendor notification
- 2026-05-10: advisory: CVE published/updated via VulnCheck