Admanager Script Injection Vulnerability
BID:4616
Info
Admanager Script Injection Vulnerability
| Bugtraq ID: | 4616 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 17 2002 12:00AM |
| Updated: | Apr 17 2002 12:00AM |
| Credit: | Discovery of this issue is credited to frog frog <[email protected]>. |
| Vulnerable: |
Admanager Admanager 1.1 |
| Not Vulnerable: | |
Discussion
Admanager Script Injection Vulnerability
Admanager is banner advertisement management software. It is written in PHP and will run on most Unix and Linux variants, in addition to Microsoft Windows operating systems.
Script code is not filtered from URL parameters of the 'add.php3' script. The attacker may exploit this to cause arbitrary script code to executed in a web user's browser, in the context of the website running Admanager.
It should be noted that 'add.php3' is a back-end script of the administrative interface of the software and ideally should not be accessible to roaming web users. However, BugTraq ID 4615 "Admanager Content Manipulation Vulnerability" describes an issue related to the lack of authentication for this particular script.
Due to the nature of the 'add.php3' script, attacker-supplied script code may potentially be stored and displayed by the ad management system.
Admanager is banner advertisement management software. It is written in PHP and will run on most Unix and Linux variants, in addition to Microsoft Windows operating systems.
Script code is not filtered from URL parameters of the 'add.php3' script. The attacker may exploit this to cause arbitrary script code to executed in a web user's browser, in the context of the website running Admanager.
It should be noted that 'add.php3' is a back-end script of the administrative interface of the software and ideally should not be accessible to roaming web users. However, BugTraq ID 4615 "Admanager Content Manipulation Vulnerability" describes an issue related to the lack of authentication for this particular script.
Due to the nature of the 'add.php3' script, attacker-supplied script code may potentially be stored and displayed by the ad management system.
Exploit / POC
Admanager Script Injection Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Admanager Script Injection Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Admanager Script Injection Vulnerability
References:
References:
- Admanager Homepage (bc.scrypty.com)
- Security holes in 11 products... (frog frog