Auction Weaver 1.0 through 1.04 does not properly validate the names of form fields, which allows remote attackers to delete arbitrary files and directories via a .. (dot dot) attack.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Auction_weaver | Cgi_script_center | 1.0 (including) | 1.0 (including) |
| Auction_weaver | Cgi_script_center | 1.01 (including) | 1.01 (including) |
| Auction_weaver | Cgi_script_center | 1.02 (including) | 1.02 (including) |
| Auction_weaver | Cgi_script_center | 1.03 (including) | 1.03 (including) |
| Auction_weaver | Cgi_script_center | 1.04 (including) | 1.04 (including) |