Admanager Content Manipulation Vulnerability

Bugtraq ID:	4615
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 17 2002 12:00AM
Updated:	Apr 17 2002 12:00AM
Credit:	Discovery of this issue is credited to frog frog <[email protected]>.
Vulnerable:	Admanager Admanager 1.1 - Apache Apache 1.3.24 - Apache Apache 1.3.24 - Apache Apache 1.3.23 - Apache Apache 1.3.23 - Apache Apache 1.3.22 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.19
Not Vulnerable:

Admanager Content Manipulation Vulnerability

Admanager is banner advertisement management software. It is written in PHP and will run on most Unix and Linux variants, in addition to Microsoft Windows operating systems.

Access to the 'add.php3' script does not require authentication. It is possible for a remote attacker to manipulate URL parameters of this script and change banner advertisement content.

Admanager Content Manipulation Vulnerability

This issue may be exploited with a web browser. The following example was submitted:

http://target/add.php3?url=http://www.url.com&adurl=http://URL/img.gif URL/

Admanager Content Manipulation Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Admanager Content Manipulation Vulnerability

References:

• Admanager Homepage (bc.scrypty.com)
  
• Security holes in 11 products... (frog frog )