Openads Admin-Search.PHP Cross-Site Scripting Vulnerability

Bugtraq ID:	22216
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 24 2007 12:00AM
Updated:	Jan 25 2007 10:29PM
Credit:	The vendor disclosed this issue.
Vulnerable:	phpAdsNew phpAdsNew 2.0.8 -pr1 phpAdsNew phpAdsNew 2.0.8 phpAdsNew phpAdsNew 2.0.7 rc1 phpAdsNew phpAdsNew 2.0.7 phpAdsNew phpAdsNew 2.0.6 phpAdsNew phpAdsNew 2.0.5 phpAdsNew phpAdsNew 2.0.4 -pr2 phpAdsNew phpAdsNew 2.0.4 -pr1 phpAdsNew phpAdsNew 2.0 beta 6 phpAdsNew phpAdsNew 2.0 beta 5 Openads phpPgAds 2.0.9-pr1 Openads phpPgAds 2.0.8-pr1 Openads pgpPgAds 2.09-pr1
Not Vulnerable:	Openads Openads for PostgreSQL 2.0.11 Openads Openads for PostgreSQL 2.0.10 Openads Openads 2.0.11 Openads Openads 2.0.10

Openads Admin-Search.PHP Cross-Site Scripting Vulnerability

Openads is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

phpAdsNew and phpPgAds 2.0.9-r1 and prior versions are vulnerable.

Openads Admin-Search.PHP Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Openads Admin-Search.PHP Cross-Site Scripting Vulnerability

Solution:
This issue was addressed in version 2.0.10; the vendor recommends acquiring version 2.0.11 or later. Please see the references section for more information.

Openads Admin-Search.PHP Cross-Site Scripting Vulnerability

References:

• Openads for PostgreSQL Homepage (Openads)
  
• Openads Homepage (Openads)
  
• phpAdsNew Homepage (Openads)
  
• [OPENADS-SA-2007-001] phpAdsNew and phpPgAds 2.0.9-pr1 vulnerability (Matteo Beccati )