Sql injection

A vulnerability was found in Itech Auction Script 6.49. It has been classified as critical. This affects an unknown part of the file /mcategory.php. The manipulation of the argument mcid with the input 4' AND 1734=1734 AND 'Ggks'='Ggks leads to sql injection Blind. It is possible to initiate the...

CVE-2017-20138

CVE-2017-20138 pertains to Itech Auction Script 6.49. Multiple connected documents confirm a blind SQL injection in /mcategory.php via the mcid parameter (example input: 4' AND 1734=1734 AND 'Ggks'='Ggks), with remote exploitability. The issue affects the mcategory.php component and is identified...

CVE-2017-20138 Itech Auction Script mcategory.php Blind sql injection

A vulnerability was found in Itech Auction Script 6.49. It has been classified as critical. This affects an unknown part of the file /mcategory.php. The manipulation of the argument mcid with the input 4' AND 1734=1734 AND 'Ggks'='Ggks leads to sql injection Blind. It is possible to initiate the...

CVE-2017-20138 Itech Auction Script mcategory.php Blind sql injection

A vulnerability was found in Itech Auction Script 6.49. It has been classified as critical. This affects an unknown part of the file /mcategory.php. The manipulation of the argument mcid with the input 4' AND 1734=1734 AND 'Ggks'='Ggks leads to sql injection Blind. It is possible to initiate the...

Ambit Technologies iTech Auction Script SQL注入漏洞

Ambit Technologies iTech Auction Script is a popular and cost-effective solution from Ambit Technologies India for launching your auction website. Ambit Technologies iTech Auction Script version 6.49 suffers from a SQL injection vulnerability that stems from the presence of an insecure file...

Attacker Can Front-run auction() To Modify Auctioneer Reward Receiver Address

Lines of code Vulnerability details Impact An attacker can front-run the auctioneer’s call to auction with another address to to receive the auctioneer reward instead of the original caller. Proof of Concept 1. Alice wants to liquidate a specific vault. 2. Mallory observes Alice's auction...

ladle address change can lead to fail other functionalities

Lines of code Vulnerability details Impact for ongoing auctions, it will not return any join. Proof of Concept Tools Used Manual Analysis Recommended Mitigation Steps add checks or set proper mechanism before change ladle address --- The text was updated successfully, but these errors were...

Funds can be stuck or lost if address(this)or address(0) is passed as to`

Lines of code Vulnerability details Impact Funds can be stuck or lost. Proof of Concept There is no checks to prevent to == addressthis or to == address0. This might lead to funds being stuck in the contract or lost. function auctionbytes12 vaultId, address to external returns DataTypes.Auction...

Collateral limit can be exceeded on a new auction

Lines of code Vulnerability details Witch's auction checks the total collateral limit before updating the structure with the current auction's data. This way this limit end up not being respected in result of auction call and can be actually breached for an arbitrary big amount as auction.ink tha...

Upgraded Q -> M from 225 [1655746069175]

Judge has assessed an item in Issue 225 as Medium risk. The relevant finding follows: C4-010 : The Dutch Auction Parameters Can be Manipulated By Owner After The Auction Started - LOW Impact - LOW Dutch Auction parameters can be changed by a malicious owner, after It is started. The malicious own...

CVE-2022-29482

'Mobaoku-Auction&Flea Market' App for iOS versions prior to 5.5.16 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack...

CVE-2022-29482

'Mobaoku-Auction&Flea Market' App for iOS versions prior to 5.5.16 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack...

CVE-2022-29482

'Mobaoku-Auction&Flea Market' App for iOS versions prior to 5.5.16 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack...

Code injection

'Mobaoku-Auction&Flea Market' App for iOS versions prior to 5.5.16 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack...

CVE-2022-29482

'Mobaoku-Auction&Flea Market' App for iOS versions prior to 5.5.16 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack...

CVE-2022-29482

The CVE-2022-29482 entry concerns the Mobaoku-Auction & Flea Market iOS app, where improper server certificate verification (CWE-295) in versions prior to 5.5.16 enables a man-in-the-middle to eavesdrop on encrypted traffic. The vulnerability is mitigated by upgrading to version 5.5.16, released ...

JVN#13878856: Mobaoku-Auction & Flea Market App for iOS vulnerable to improper server certificate verification

Mobaoku-Auction & Flea Market App for iOS provided by DeNA Co., Ltd. is vulnerable to improper server certificate verification CWE-295. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the application Update the application to the...

Strike price curve of getDutchAuctionStrike is not what users expect

Lines of code Vulnerability details Note: This submission contains links to a private fork of the contest repo. User code423n4 has been added as a collaborator in order to view. Impact Function getDutchAuctionStrike does not implement the function that Option buyers would expect. They probably...

getDutchAuctionStrike () will return an unfavourable output for seller

Lines of code Vulnerability details Impact The protocol depends on the mentioned function decrementing to 0 or to the reserveStrikeif any is set by the seller of the option. After testing the efficiency of of getDutchAuctionStrike , it will return a value lower than the reserveStrike 2-3hrs prior...

Loss of asset due to improperly setting dutchAuctionReserveStriked

Lines of code Vulnerability details The Option writer Victim believes they will be writing a call option, but ends up selling their asset at a discount. Proof of Concept If dutchAuctionReserveStrike is improperly set, the writer is effectively writing a call option that is immediately in the mone...