PT-2005-3184 · Phpauction · Phpauction

Published 2005-07-13 · Updated 2008-09-05 · CVE-2005-2255

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: PhpAuction version 2.5

Description: A directory traversal issue allows remote attackers to read arbitrary files, include local PHP files, or obtain sensitive path information. This is achieved by using ".." sequences in the lan parameter to API endpoints such as "/index.php" or "/admin/index.php".

Recommendations: For PhpAuction version 2.5, consider restricting access to the lan parameter in the affected API endpoints until a patch is available. As a temporary workaround, disabling the ability to include local PHP files via the lan parameter can help minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-2255

Affected Products

Phpauction

References · 3

• 🔥 http://securitytracker.com/id?1014423 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-2255 · Security Note
• http://secunia.com/advisories/15967 · Note