CVE-2009-3600

CVE-2009-3600 affects HUBScript 1.0. The vulnerability is an information-disclosure in the web management path: a direct request to manage/phpinfo.php causes phpinfo() to reveal configuration details. The root cause is exposing PHP configuration via phpinfo() without proper access controls. Impac...

CVE-2009-3599

CVE-2009-3599 is an XSS vulnerability in HUBScript 1.0 affecting single_winner1.php, exploitable via the bid_id parameter. The weakness allows remote attackers to inject arbitrary web script/HTML. Public references in the sources (Secunia, OSVDB, Packet Storm, X-Force) confirm the issue but do no...