PT-2002-1327 · Makebid · Makebid Auction Deluxe

Published 2002-05-03 · Updated 2016-10-18 · CVE-2002-0257

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MakeBid Auction Deluxe version 3.30

Description A cross-site scripting issue exists, allowing remote attackers to obtain information from other users via form fields, including TITLE, DESCTIT, DESC, searchstring, ALIAS, EMAIL, ADDRESS1, ADDRESS2, ADDRESS3, PHONE1, PHONE2, PHONE3, and PHONE4.

Recommendations For MakeBid Auction Deluxe version 3.30, update the auction.pl script to properly sanitize user input in the form fields to prevent cross-site scripting attacks.

Fix

Related Identifiers

CVE-2002-0257

Affected Products

Makebid Auction Deluxe

References · 6

• http://iss.net/security_center/static/8161.php · Vendor Advisory
• http://securityfocus.com/bid/4069 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0257 · Security Note
• http://netcreations.addr.com/dcforum/DCForumID2/126.html · Note
• http://marc.info/?l=bugtraq&m=101328880521775&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0257 · Note