CVE-2005-2253

SQL injection vulnerability in PhpAuction 2.5 allow remote attackers to modify SQL queries via the category parameter to adsearch.php. NOTE: there is evidence that viewnews.php may not be part of the PhpAuction product, so it is not included in this description...

CVE-2005-2255

Directory traversal vulnerability in PhpAuction 2.5 allows remote attackers to read arbitrary files, include local PHP files, or obtain sensitive path information via ".." sequences in the lan parameter to 1 index.php or 2 admin/index.php...

CVE-2005-2255

CVE-2005-2255 describes a directory traversal in PhpAuction 2.5 where an attacker can manipulate the lan parameter in index.php or admin/index.php to read arbitrary files, include local PHP files, or glean sensitive path information. The root cause is improper validation of the lan parameter allo...

CVE-2005-2253

SQL injection vulnerability in PhpAuction 2.5 allow remote attackers to modify SQL queries via the category parameter to adsearch.php. NOTE: there is evidence that viewnews.php may not be part of the PhpAuction product, so it is not included in this description...

CVE-2005-2254

Multiple cross-site scripting XSS vulnerabilities in PhpAuction 2.5 allow remote attackers to inject arbitrary web script or HTML via the lan parameter to 1 index.php or 2 admin/index.php, or 3 the auctionid parameter to profile.php. NOTE: there is evidence that viewnews.php and login.php may not...

CVE-2005-2252

PhpAuction 2.5 allows remote attackers to bypass authentication and gain privileges as another user by setting the PHPAUCTIONRMID cookie to the user ID...

CVE-2005-2252

PhpAuction 2.5 allows remote attackers to bypass authentication and gain privileges as another user by setting the PHPAUCTIONRMID cookie to the user ID...

CVE-2005-2252

Summary (CVE-2005-2252): PhpAuction 2.5 is affected by an authentication bypass vulnerability where an attacker can set the PHPAUCTION_RM_ID cookie to a target user’s ID to gain privileges as that user. The Nessus plugin PHPAUCTION_MULT_VULNS.NASL documents this issue among others (e.g., RCE, SQL...

CVE-2005-2255

Directory traversal vulnerability in PhpAuction 2.5 allows remote attackers to read arbitrary files, include local PHP files, or obtain sensitive path information via ".." sequences in the lan parameter to 1 index.php or 2 admin/index.php...

CVE-2005-2254

The connected NASL/Nessus entry confirms CVE-2005-2254 affects Phpauction

CVE-2005-2253

CVE-2005-2253 is a SQL injection in PhpAuction 2.5, where an attacker can modify SQL queries through the category parameter in adsearch.php. Root cause: unsanitized input used in database queries. Affected: PhpAuction 2.5. Impact: as described by CVE/NVD (base score 7.5, HIGH). Exploitation detai...

PHPAUCTION Multiple Vulnerabilities

Binary data 3055.prm...

phpAuctionMulti.txt

This is a multi-part message in MIME format. ------=NextPart000000901C58325.6436F8C0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable -------------------------------------------------------------------------= ------- Dcrab 's Security Advisory...

phpAuction 2.5 - Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/14184/info PHPAuction is affected by multiple remote vulnerabilities. These issues can allow an attacker to gain unauthorized access to a site and carry out SQL injection and cross-site scripting attacks. PHPAuction 2.5 is reported to be affected by these...

phpAuction 2.5 - Multiple Vulnerabilities

phpAuction 2.5 - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/14184/info PHPAuction is affected by multiple remote vulnerabilities. These issues can allow an attacker to gain unauthorized access to a site and carry out SQL injection and cross-site scripting attacks. PHPAucti...

CVE-2002-0995

PHPAuction's login.php is vulnerable: a direct call with action=insert allows remote attackers to add a username to the adminUsers table, effectively gaining privileges. The CVE entry documents this privilege escalation and labels it high severity (CVSS v2 base score 7.5). The provided sources co...

CVE-2002-0995

login.php for PHPAuction allows remote attackers to gain privileges via a direct call to login.php with the action parameter set to "insert," which adds the provided username to the adminUsers table...

CVE-2002-0995

login.php for PHPAuction allows remote attackers to gain privileges via a direct call to login.php with the action parameter set to "insert," which adds the provided username to the adminUsers table...

phpAuction 1/2 - Unauthorized Administrative Access

source: https://www.securityfocus.com/bid/5141/info PhpAuction is a freely available web-based auction system. It is written using PHP scripting language on a MySQL database engine. A flaw in /admin/login.php has been reported in PHPAuction, which could allow users to gain escalated privileges...

phpAuction 12 - Unauthorized Administrative Access

phpAuction 12 - Unauthorized Administrative Access source: https://www.securityfocus.com/bid/5141/info PhpAuction is a freely available web-based auction system. It is written using PHP scripting language on a MySQL database engine. A flaw in /admin/login.php has been reported in PHPAuction, whic...