CVE:CVE-2009-0108
CNNVD:CNNVD-200901-097
PHPAuctions是一款基于PHP的WEB应用程序。
PHPAuctions(又称PHPAuctionSystem)存在权限许可和访问控制漏洞。远程攻击者借助修改过的(1)PHPAUCTION_RM_ID
(2)PHPAUCTION_RM_NAME
(3)PHPAUCTION_RM_USERNAME
(4)PHPAUCTION_RM_EMAIL cookies
绕过身份认证和获得管理访问权限。
solution:Upgrade phpauctions phpauctions to a higher version than _nil_,and avoid the version _nil_