OpenX 'MAX_type' Parameter Local File Include Vulnerability

Bugtraq ID:	33458
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 26 2009 12:00AM
Updated:	Jan 30 2009 10:39PM
Credit:	Charlie and Sarid Harper of Secunia Research
Vulnerable:	OpenX OpenX 2.6.2 OpenX OpenX 2.6.1 OpenX OpenX 2.4.9 OpenX OpenX 2.4.8 OpenX Openads 2.0.11
Not Vulnerable:

OpenX 'MAX_type' Parameter Local File Include Vulnerability

OpenX is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to view files and execute local scripts in the context of the webserver process. This may aid in further attacks.

OpenX 2.6.3 is affected; other versions may also be vulnerable.

OpenX 'MAX_type' Parameter Local File Include Vulnerability

Attackers can exploit this issue with a browser.

The following example URI is available:

http://www.example.com/www/delivery/fc.php?MAX_type= ../../../../../../../../../../../../../../../etc/passwd%00

OpenX 'MAX_type' Parameter Local File Include Vulnerability

Solution:
Vendor updates are available. Contact the vendor for details.

OpenX 'MAX_type' Parameter Local File Include Vulnerability

References:

• OpenX Homepage (OpenX)
  
• OpenX 2.6.3 - Local File Inclusion ([email protected])
  
• Re: Secunia Research: OpenX Multiple Vulnerabilities ([email protected])
  
• Secunia Research: OpenX Multiple Vulnerabilities (Secunia Research )
  
• Secunia Research: OpenX Multiple Vulnerabilities (Secunia)