Multiple Products 'banner.swf' Cross-Site Scripting Vulnerability

Bugtraq ID:	38732
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 15 2010 12:00AM
Updated:	Mar 15 2010 12:00AM
Credit:	MustLive
Vulnerable:	phpAdsNew phpAdsNew 2.0.8 -pr1 phpAdsNew phpAdsNew 2.0.8 phpAdsNew phpAdsNew 2.0.7 rc1 phpAdsNew phpAdsNew 2.0.7 phpAdsNew phpAdsNew 2.0.6 phpAdsNew phpAdsNew 2.0.5 phpAdsNew phpAdsNew 2.0.4 -pr2 phpAdsNew phpAdsNew 2.0.4 -pr1 phpAdsNew phpAdsNew 2.0 beta 6 phpAdsNew phpAdsNew 2.0 beta 5 phpAdsNew phpAdsNew 2.0.9-pr1 OpenX OpenX 2.8.2 OpenX OpenX 2.8.1 OpenX OpenX 2.6.5 OpenX OpenX 2.6.4 OpenX OpenX 2.6.2 OpenX OpenX 2.6.1 OpenX OpenX 2.4.11 OpenX OpenX 2.4.10 OpenX OpenX 2.4.9 OpenX OpenX 2.4.8 OpenX OpenX 2.8 OpenX OpenX 2.7.29-beta OpenX Openads 2.0.11 Openads Openads 2.4.3 Openads Openads 2.4.2 Openads Openads 2.4 Openads Openads 2.0.11 Openads Openads 2.0.10 Openads Openads 2.3.31-alpha-pr3 Openads Openads 2.3.31-alpha-pr2 Openads Openads 2.0.11-pr1
Not Vulnerable:

Multiple Products 'banner.swf' Cross-Site Scripting Vulnerability

Multiple products are prone to a cross-site scripting vulnerability because the applications fail to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The following products are affected:

phpAdsNew
OpenAds
OpenX

Multiple Products 'banner.swf' Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

The following example URI is available:

• /data/vulnerabilities/exploits/38732.txt

Multiple Products 'banner.swf' Cross-Site Scripting Vulnerability

References:

• Openads Homepage (Openads)
  
• OpenX Homepage (OpenX)
  
• phpAdsNew Homepage (phpAdsNew)
  
• Vulnerability in phpAdsNew, OpenAds and OpenX ('MustLive' )