PT-2002-2425 · Mewsoft · Mewsoft Netauction

Published 2002-12-31 · Updated 2017-07-11 · CVE-2002-1703

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mewsoft NetAuction version 3.0

Description The issue is related to a cross-site scripting vulnerability (XSS) in the auction.cgi component. It allows remote attackers to execute arbitrary script as other users via the Term parameter in the affected API endpoint.

Recommendations For Mewsoft NetAuction version 3.0, consider restricting access to the Term parameter in the auction.cgi component to minimize the risk of exploitation. As a temporary workaround, avoid using the Term parameter until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2002-1703

Affected Products

Mewsoft Netauction

References · 5

• 🔥 https://exploit-db.com/exploits/21553 · Exploit
• 🔥 http://securityfocus.com/bid/5023 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-1703 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/9365 · Note
• http://online.securityfocus.com/archive/1/277049 · Note