PHPAds 2.0 XSS Vulnerability

vendor:

PHPAds

by:

Danny Moules

7.5

CVSS

HIGH

Cross-Site Scripting (XSS)

CWE

Product Name: PHPAds

Affected Version From: 2

Affected Version To: 2

Patch Exists: Yes

Related CWE: N/A

CPE: 2.3:a:blondish.net:phpads:2.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

PHPAds 2.0 XSS Vulnerability

Due to insufficient validation of client-side data, an attacker can inject script directly into the code displayed as an advertisement to users. When making a new advertisement (or editing an old one), an attacker can fill the Ad Name field with malicious code and submit the form as usual. Whenever that particular ad is viewed, the script is executed.

Mitigation:

Validate all user-supplied input to prevent malicious code injection.

Source

Exploit-DB raw data:

Vendor: http://blondish.net
Version(s): PHPAds 2.0 (May also affect earlier versions)
Credit: Danny Moules
Critical: Yes

See PUSH 55 Advisory at http://www.push55.co.uk/advisories.php?id=8

----

First, we need to acquire administrative access. We point our browser at 'http://www.example.com/ads/ads.dat'. Simple.

Due to insufficient validation of client-side data, we can inject script directly into the code displayed as an advertisement to users.

When making a new advertisement (or editing an old one), we simply fill the Ad Name field with the following:

-
" border="0"> <script>alert('xss');</script><img
-

and otherwise submit the form as usual. Obviously there are other vectors, but this is intended to be clean so the users will never see anything amiss.

Whenever that particular ad is viewed is viewed, the script is executed.

# milw0rm.com [2009-01-19]