Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: PHP :: b06-1239.htm

phpAdsNew and phpPgAds 2.0.8 fix multiple vulnerabilities



phpAdsNew and phpPgAds 2.0.8 fix multiple vulnerabilities
phpAdsNew and phpPgAds 2.0.8 fix multiple vulnerabilities



=======================================================================phpAdsNew / phpPgAds security advisory             PHPADSNEW-SA-2006-001
------------------------------------------------------------------------
Advisory ID:           PHPADSNEW-SA-2006-001
Date:                  2006-Mar-27
Security risk:         medium risk
Applications affetced: phpAdsNew, phpPgAds
Versions affected:     <= 2.0.7
Versions not affected: >= 2.0.8
=======================================================================

=======================================================================Vulnerability 1:  HTML injection / Cross-site scripting
=======================================================================
Description
-----------
Some scripts inside the admin interface were displaying parameters 
collected by the delivery scripts without proper sanitizing or escaping. 
The delivery scripts have public access, while the admin interface is 
restricted to logged in users. An attacker could inject HTML/XSS code 
which could be displayed/executed in a later time inside the admin 
interface.

Solution
--------
- Upgrade to phpAdsNew or phpPgAds 2.0.8.


=======================================================================Vulnerability 2:  HTML injection / Cross-site scripting
=======================================================================
Description
-----------
The login form was sending back to the browser the unmodified query 
string, making possible for an attacker to inject HTML/XSS code by using 
a specifically crafted URL.

Solution
--------
- Upgrade to phpAdsNew or phpPgAds 2.0.8.


Contact informations
===================
The security contact for phpAdsNew and phpPgAds can be reached at:



Best regards
--
Matteo Beccati
http://phpadsnew.com 
http://phppgads.com 


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH