Pay Per Watch %26 Bid Auktions System CVE-2010-1854 Cross-Site Scripting Vulnerability

Bugtraq ID:	73741
Class:	Input Validation Error
CVE:	CVE-2010-1854
Remote:	Yes
Local:	No
Published:	May 07 2010 12:00AM
Updated:	May 07 2010 12:00AM
Credit:	Unknown
Vulnerable:	phpscripte24 Pay Per Watch %26 Bid Auktions System 0
Not Vulnerable:

Pay Per Watch %26 Bid Auktions System CVE-2010-1854 Cross-Site Scripting Vulnerability

Pay Per Watch %26 Bid Auktions System is prone to a cross-site scripting vulnerability. Cross-site scripting (XSS) vulnerability in auktion.php in Pay Per Watch & Bid Auktions System allows remote attackers to inject arbitrary web script or HTML via the id_auk parameter, which is not properly handled in a forced SQL error message. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this might be resultant from CVE-2010-1855.

Pay Per Watch %26 Bid Auktions System CVE-2010-1854 Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

Pay Per Watch %26 Bid Auktions System CVE-2010-1854 Cross-Site Scripting Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or you are aware of more recent information, please mail us at: [email protected]

Pay Per Watch %26 Bid Auktions System CVE-2010-1854 Cross-Site Scripting Vulnerability

References:

• Security Advisory SA39059 - Pay Per Watch & Bid Auktions System "id_auk (SECUNIA)