Executive brief
uBidAuction is a web-based platform used to create and manage online auction websites. A security flaw in its filtering system allows attackers to execute malicious scripts in the browsers of other users, including administrators. This could lead to unauthorized actions, theft of login sessions, or the display of fraudulent content to users.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in uBidAuction v2.0.1 due to improper neutralization of input in the 'filter' web module. Specifically, the parameters 'date_created', 'date_from', 'date_to', and 'created_at' are not properly sanitized before being rendered in the web page. An unauthenticated remote attacker can exploit this by tricking a user into clicking a specially crafted URL containing a malicious payload in a GET request. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session, which can be used for session hijacking, phishing, or unauthorized redirection. Affected modules include auctions/manage, orders/myOrders, and several others utilizing the filter functionality.
Affected products
- ApPHP uBidAuction 2.0.1
Timeline
- 2022-01-21: disclosed: Public disclosure by Vulnerability Laboratory
- 2022-09-02: other: Vendor notification
- 2026-05-10: advisory: NVD publication date