uBidAuction Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in uBidAuction version 2.0.1, specifically within the news/manage module. The vulnerability arises from improper sanitization of the date_created, date_from, date_to, and created_at parameters in the filter functionality. This oversight allows remote attackers to inject malicious scripts through crafted GET requests, which are executed in the browsers of victims.

Impact

Exploitation of this vulnerability allows for session hijacking, non-persistent phishing attacks, external redirects to malicious sources, and manipulation of affected application modules.

Reproduction

The vulnerability can be reproduced by sending a GET request to the news/manage module with an injected script in the created_at parameter. This can be done using a web browser or a tool that allows for the modification of GET request parameters. The injected script will be executed in the browser, demonstrating the cross-site scripting vulnerability.

Remediation

To address this vulnerability, it is recommended to implement proper input validation and output sanitization for the affected parameters. Disallow special characters in the date_created, date_from, date_to, and created_at parameters when using the GET method. Additionally, sanitize the output in the filter module to prevent script execution.