Traq admincp/common.php authenticate() Function Authentication Bypass Remote Code Execution

high Nessus Plugin ID 62892


The remote web server hosts an application that allows arbitrary code execution.


The version of Traq installed on the remote host contains a flaw that could allow a remote attacker to bypass the authentication mechanism and inject and execute arbitrary code. The flaw is caused by the application failing to properly restrict admin rights in the 'authenticate()' function in 'admincp/common.php'.

Note that successful exploitation of this issue, such as by this plugin, results in a persistent change to the site. To undo this change, the 'traq_plugin_code' table of the MySQL database will need to be modified to remove the code added by this plugin.


Upgrade to version 2.3.1 or later.

See Also

Plugin Details

Severity: High

ID: 62892

File Name: traq_authenticate_function_code_execution.nasl

Version: 1.9

Type: remote

Family: CGI abuses

Published: 11/12/2012

Updated: 4/11/2022

Configuration: Enable thorough checks

Risk Information


Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:C


Risk Factor: High

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: x-cpe:/a:traq:traq

Required KB Items: www/traq, www/PHP

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Patch Publication Date: 12/2/2011

Vulnerability Publication Date: 12/7/2011

Exploitable With

Metasploit (Traq admincp/common.php Remote Code Execution)

Elliot (Traq 2.3 RCE)

Reference Information

BID: 50961