Active Auction 'search' Parameter SQL Injection and Cross Site Scripting Vulnerabilities

Bugtraq ID:	33306
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 15 2009 12:00AM
Updated:	Jan 19 2009 05:12PM
Credit:	Pouya_Server
Vulnerable:	Active Web Softwares Active Auction Pro 0 Active Web Softwares Active Auction House
Not Vulnerable:

Active Auction 'search' Parameter SQL Injection and Cross Site Scripting Vulnerabilities

Active Auction House and Active Auction Pro are prone to SQL-injection and cross-site scripting vulnerabilities because they fail to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Active Auction 'search' Parameter SQL Injection and Cross Site Scripting Vulnerabilities

The following example URIs are available:

http://www.example.com/[Path]/search.asp?search='[SQL]&submit=%3E

http://www.example.com/[Path]/stores.asp?search='[SQL]&submit=Search

http://www.example.com/[Path]/search.asp?search=<meta+http-equiv='Set-cookie'+content='cookiename=cookievalue'>&submit=%3E

http://www.example.com/[Path]/search.asp?search=>"><ScRiPt%20%0a%0d>alert(1369)%3B</ScRiPt>&submit=%3E

Active Auction 'search' Parameter SQL Injection and Cross Site Scripting Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Active Auction 'search' Parameter SQL Injection and Cross Site Scripting Vulnerabilities

References:

• Active Auction House (ActiveWebSoftwares.com)
  
• Active Auction Pro (ActiveWebSoftwares.com)
  
• ActiveWebSoftwares Homepage (ActiveWebSoftwares.com)