CVE-2009-0108

PHPAuctions (aka PHPAuctionSystem) allows remote attackers to bypass authentication and gain...

7.5 HighPublic exploit

CVE-2009-0108 is a high vulnerability (CVSS 7.5) in Phpauctions, published January 9, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.55%, the 85th percentile. No source names a fixed version.

PHPAuctions (aka PHPAuctionSystem) allows remote attackers to bypass authentication and gain administrative access via modified (1) PHPAUCTION_RM_ID, (2) PHPAUCTION_RM_NAME, (3) PHPAUCTION_RM_USERNAME, and (4) PHPAUCTION_RM_EMAIL cookies.

Exploit likelihood

2.55%Down 1.9 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2009-0108
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Record: CVE-2009-0108
Updated: 2026-11-02

EUVDEUVD-2009-0117 No score

Record: EUVD-2009-0117
Updated: 2026-11-03

GitHub AdvisoriesGHSA-j2jf-9wq5-5895 No score

PHPAuctions (aka PHPAuctionSystem) allows remote attackers to bypass authentication and gain...

Record: GHSA-j2jf-9wq5-5895
Updated: 2026-11-02

Affected products

phpauctions

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	PHPAuctionSystem - Insecure Cookie Handling	2009-01-05

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, NVD

Exploit likelihood

What each source reports

Affected products

Public exploits

History

References