PHPAuction Unauthorized Administrative Access Vulnerability

PhpAuction is a freely available web-based auction system. It is written using PHP scripting language on a MySQL database engine.

A flaw in /admin/login.php has been reported in PHPAuction, which could allow users to gain escalated privileges.

Submitting authentication credentials via login.php will create the user account with adminsitrative permissions.


 

Privacy Statement
Copyright 2010, SecurityFocus