PT-2005-3184 · Phpauction · Phpauction

Publicado 2005-07-13 · Atualizado 2008-09-05 · CVE-2005-2255

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: PhpAuction version 2.5

Description: A directory traversal issue allows remote attackers to read arbitrary files, include local PHP files, or obtain sensitive path information. This is achieved by using ".." sequences in the lan parameter to API endpoints such as "/index.php" or "/admin/index.php".

Recommendations: For PhpAuction version 2.5, consider restricting access to the lan parameter in the affected API endpoints until a patch is available. As a temporary workaround, disabling the ability to include local PHP files via the lan parameter can help minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2005-2255

Produtos afetados

Phpauction

Referências · 3

• 🔥 http://securitytracker.com/id?1014423 · Exploit
• http://secunia.com/advisories/15967 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-2255 · Nota de Segurança