Vulnerability in Usanet Creations Domain Name Auction

CVE-2005-2259

The dispallclosed2 function in dispallclosed.pl for multiple USANet Creations products, including (1) USANet Shopping Mall Software, (2) Domain Name Auction Software, (3) Standard Classified Ads Software, and (4) MakeBid Reverse Auction allows remote attackers to execute arbitrary code via shell metacharacters in the DISPCLOSED parameter.

EPSS: 0.042 (90.0th percentile) — read the EPSS interpretation.

Affected products

Usanet_creations Domain_name_auction
Usanet_creations Makebid_auction_deluxe — versions 3.30
Usanet_creations Makebid_auction_standard
Usanet_creations Makebid_reverse_auction
Usanet_creations Standard_classified_ads
Usanet_creations Usanet_shopping_mall
N/a — versions n/a

References

cve@mitre.org (vdb-entry, x_refsource_BID)
cve@mitre.org (x_refsource_SECUNIA, third-party-advisory)
cve@mitre.org (vdb-entry, x_refsource_SECTRACK, Vendor Advisory)