PHPAds version 2.0 suffers from administrative bypass and cross site scripting vulnerabilities.
c12bcdb2388d348913cec836ab01dc0db9ea270c2b7fe5435a04997858b9eb93
Vendor: http://blondish.net
Version(s): PHPAds 2.0 (May also affect earlier versions)
Credit: Danny Moules
Critical: Yes
See PUSH 55 Advisory at http://www.push55.co.uk/advisories.php?id=8
----
First, we need to acquire administrative access. We point our browser at 'http://www.example.com/ads/ads.dat'. Simple.
Due to insufficient validation of client-side data, we can inject script directly into the code displayed as an advertisement to users.
When making a new advertisement (or editing an old one), we simply fill the Ad Name field with the following:
-
" border="0"> <script>alert('xss');</script><img
-
and otherwise submit the form as usual. Obviously there are other vectors, but this is intended to be clean so the users will never see anything amiss.
Whenever that particular ad is viewed is viewed, the script is executed.