PHPAuctions (aka PHPAuctionSystem) allows remote attackers to bypass authentication and gain administrative access via modified (1) PHPAUCTION_RM_ID (2) PHPAUCTION_RM_NAME (3) PHPAUCTION_RM_USERNAME and (4) PHPAUCTION_RM_EMAIL cookies.