Technical Description

Multiple vulnerabilities have been identified in PHP Auction System, which could be exploited by remote attackers to bypass security restrictions or inject arbitrary SQL queries and scripting code.

The first issue is caused by a design error in the web interface that relies on cookie data to authenticate users, which could be exploited by attackers to bypass authentication and gain unauthorized access to a vulnerable application via a specially crafted cookie.

The second vulnerability is caused by by an input validation error in the "profile.php" script when processing the "user_id" parameter, which could be exploited by malicious people to conduct SQL injection attacks.

The third issue is caused by an input validation error in the "profile.php" script when processing the "auction_id" parameter, which could be exploited by attackers to cause arbitrary scripting code to be executed by the user's browser in the security context of an affected site.

Affected Products

PHP Auction System (PHPAuctionSystem)

Solution

VUPEN Security is not aware of any vendor-supplied patch.

References

http://www.vupen.com/english/advisories/2009/0027

Credits

Vulnerabilities reported by ZoRLu and x0r.

ChangeLog

2009-01-06 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time e-mail and SMS alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.