Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
login.php for PHPAuction allows remote attackers to gain privileges via a direct call to login.php with the action parameter set to "insert," which adds the provided username to the adminUsers table.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
PHPAuction未授权远程管理接口访问漏洞
Vulnerability Description
PhpAuction是一款免费开放源代码的基于WEB的拍卖系统，使用PHP+MYSQL实现。 PHPAuction中的login.php对用户提交的URL请求缺少正确判断，远程攻击者可以利用这个漏洞建立管理员权限的用户帐户。 PHPAuction中的/admin/login.php脚本只检查$action是否设置为"insert"，如果是的情况下，就直接转向在管理员用户表中插入用户名和密码操作，攻击者可以提交非法URL请求导致在系统中增加具有管理员权限的帐户。
CVSS Information
N/A
Vulnerability Type
N/A