Exploitation Summary
EIP tracks 1 public exploit for CVE-2022-50962. PoCs published by Vulnerability-Lab.
AI-analyzed exploit summary The exploit demonstrates multiple non-persistent XSS vulnerabilities in uBidAuction v2.0.1 by injecting malicious script codes into vulnerable parameters such as 'date_created', 'date_from', 'date_to', and 'created_at'. The PoC includes specific URLs and payloads that trigger the XSS when processed by the application.
Description
uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the orders/myOrders module. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.
Exploits (1)
The exploit demonstrates multiple non-persistent XSS vulnerabilities in uBidAuction v2.0.1 by injecting malicious script codes into vulnerable parameters such as 'date_created', 'date_from', 'date_to', and 'created_at'. The PoC includes specific URLs and payloads that trigger the XSS when processed by the application.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N