PHPAdsNew AdFrame.PHP Cross-Site Scripting Vulnerability

Bugtraq ID:	12803
Class:	Input Validation Error
CVE:	CVE-2005-0791
Remote:	Yes
Local:	No
Published:	Mar 14 2005 12:00AM
Updated:	Jul 12 2009 10:56AM
Credit:	Discovery of this vulnerability is credited to Maksymilian Arciemowicz <[email protected]>.
Vulnerable:	phpAdsNew phpAdsNew 2.0.4 -pr1
Not Vulnerable:	phpAdsNew phpAdsNew 2.0.4 -pr2

PHPAdsNew AdFrame.PHP Cross-Site Scripting Vulnerability

phpAdsNew is reportedly affected by a remote cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

PHPAdsNew AdFrame.PHP Cross-Site Scripting Vulnerability

No exploit is required.

The following proof of concept is available:
http://www.example.com/[phpAdsNew]/adframe.php?refresh=example.com'>[XSS code]

PHPAdsNew AdFrame.PHP Cross-Site Scripting Vulnerability

Solution:
The vendor has released phpAdsNew 2.0.4-pr2 to address this issue.


phpAdsNew phpAdsNew 2.0.4 -pr1

• phpAdsNew phpAdsNew-2.0.4-pr2.tar.gz
  http://prdownloads.sourceforge.net/phpadsnew/phpAdsNew-2.0.4-pr2.tar.g z?download

PHPAdsNew AdFrame.PHP Cross-Site Scripting Vulnerability

References:

• phpAdsNew Homepage (phpAdsNew)
  
• Release Name: phpAdsNew 2.0.4-pr2 (phpAdsNew)
  
• [SECURITYREASON.COM] phpAdsNew 2.0.4-pr1 Multiple vulnerabilities cXIb8O3.9 (Maksymilian Arciemowicz )