CVE-2022-50963
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A reflected XSS vulnerability exists in the auctions/myAuctions/status/active module of uBidAuction 2.0.1. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.
Risk Assessment
Attackers can steal user sessions, redirect victims to malicious sites, or exfiltrate sensitive data, compromising system confidentiality and integrity.
Recommendation
Update uBidAuction to the latest version with fixed parameter filtering and implement server-side input validation.
Original NVD description (English source)
uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the auctions/myAuctions/status/active module. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.