Home page logo

fulldisclosure logo Full Disclosure mailing list archives

[PHPADSNEW-SA-2006-002] phpAdsNew and phpPgAds 2.0.8-pr1 fix XSS vulnerability
From: Matteo Beccati <security () phpadsnew com>
Date: Mon, 23 Oct 2006 09:27:16 +0200

phpAdsNew / phpPgAds security advisory             PHPADSNEW-SA-2006-002
Advisory ID:               PHPADSNEW-SA-2006-002
Date:                      2006-Oct-28
Security risk:             medium risk
Applications affected:     phpAdsNew, phpPgAds
Applications not affected: Max Media Manager v0.1.x - v0.3.x
Versions affected:         <= 2.0.8
Versions not affected:     >= 2.0.8-pr1

Vulnerability:  HTML injection / Cross-site scripting

Some scripts inside the admin interface were displaying parameters
collected by the delivery scripts without proper sanitizing or escaping.
The delivery scripts have public access, while the admin interface is
restricted to logged in users. An attacker could inject HTML/XSS code
which could be displayed/executed in a later time inside the admin

- Upgrade to phpAdsNew or phpPgAds 2.0.8-pr1.

Contact informations

The security contact for phpAdsNew and phpPgAds can be reached at:
<security AT phpadsnew DOT com>

Best regards
Matteo Beccati

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
  • [PHPADSNEW-SA-2006-002] phpAdsNew and phpPgAds 2.0.8-pr1 fix XSS vulnerability Matteo Beccati (Oct 23)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]