phpauctions vulnerabilities and fixes

Recent CVEs affecting phpauctions, with upgrade or downgrade steps. 4 tracked.

phpauctions has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2009-04-08. Highest priority: CVE-2009-0108 (score 53/100).

• CVE-2009-0108 HIGH 7.5 DOWNGRADE PHPAuctions (aka PHPAuctionSystem) allows remote attackers to bypass authentication and gain administrative ac
• CVE-2009-0107 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in profile.php in PHPAuctions (aka PHPAuctionSystem) allows remote at
• CVE-2009-0106 HIGH 7.5 DOWNGRADE SQL injection vulnerability in profile.php in PHPAuctions (aka PHPAuctionSystem) allows remote attackers to ex
• CVE-2008-6663 HIGH 7.5 MITIGATE SQL injection vulnerability in profile.php in PHPAuctions.info PHPAuctions (aka PHPAuctionSystem) allows remot

FAQ

How do I fix phpauctions vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is phpauctions being exploited right now?

None of the tracked phpauctions CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which phpauctions CVE should I patch first?

CVE-2009-0108 currently ranks highest (53/100): PHPAuctions (aka PHPAuctionSystem) allows remote attackers to bypass authentication and gain administrative ac.

RSS feed for phpauctions · ← Back to latest CVEs