header-logo
Suggest Exploit
vendor:
OpenX
by:
7.5
CVSS
HIGH
Cross-Site Scripting, SQL Injection
79, 89
CWE
Product Name: OpenX
Affected Version From: 2.8.10
Affected Version To:
Patch Exists: NO
Related CWE:
CPE:
Metasploit:
Other Scripts:
Platforms Tested:

OpenX Cross-Site Scripting and SQL Injection Vulnerabilities

OpenX is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Mitigation:

To mitigate the cross-site scripting vulnerability, it is recommended to sanitize and validate user-supplied data before using it in dynamic web pages. To mitigate the SQL-injection vulnerability, it is recommended to use parameterized queries or prepared statements to handle user-supplied data.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/55860/info

OpenX is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

OpenX 2.8.10 is vulnerable; other versions may also be affected. 

http://www.example.com/www/admin/plugin-index.php?action=info&group=vastInlineBannerTypeHtml&parent=%22%3E%3C script%3Ealert%28document.cookie%29;%3C/script%3E [XSS]

Navigation

Suggest Exploit

Services By CQR