PT-2002-1327 · Makebid · Makebid Auction Deluxe

Publicado 2002-05-03 · Atualizado 2016-10-18 · CVE-2002-0257

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MakeBid Auction Deluxe version 3.30

Description A cross-site scripting issue exists, allowing remote attackers to obtain information from other users via form fields, including TITLE, DESCTIT, DESC, searchstring, ALIAS, EMAIL, ADDRESS1, ADDRESS2, ADDRESS3, PHONE1, PHONE2, PHONE3, and PHONE4.

Recommendations For MakeBid Auction Deluxe version 3.30, update the auction.pl script to properly sanitize user input in the form fields to prevent cross-site scripting attacks.

Correção

Identificadores relacionados

CVE-2002-0257

Produtos afetados

Makebid Auction Deluxe

Referências · 6

• http://netcreations.addr.com/dcforum/DCForumID2/126.html · Nota
• http://marc.info/?l=bugtraq&m=101328880521775&w=2 · Nota
• http://iss.net/security_center/static/8161.php · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0257 · Nota
• http://securityfocus.com/bid/4069 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2002-0257 · Nota de Segurança