VULHUB ™

Auction Weaver does not perform proper sanity checking within certain form fields. It is possible for any remote user to delete arbitrary files and directories through the use of the double dot "..". This affects files and directories within and outside of the web root. While deleting an entire directory, Auction Weaver may fail when attempting to delete any subdirectories. However, any files above the subdirectory would have been successfully deleted.

Auction Weaver does not perform proper sanity checking within certain form fields. It is possible for any remote user to delete arbitrary files and directories through the use of the double dot "..". This affects files and directories within and outside of the web root. While deleting an entire directory, Auction Weaver may fail when attempting to delete any subdirectories. However, any files above the subdirectory would have been successfully deleted.