lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 23 Oct 2006 09:27:16 +0200
From: Matteo Beccati <security@...adsnew.com>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: [PHPADSNEW-SA-2006-002] phpAdsNew and phpPgAds 2.0.8-pr1 fix XSS vulnerability

========================================================================
phpAdsNew / phpPgAds security advisory             PHPADSNEW-SA-2006-002
------------------------------------------------------------------------
Advisory ID:               PHPADSNEW-SA-2006-002
Date:                      2006-Oct-28
Security risk:             medium risk
Applications affected:     phpAdsNew, phpPgAds
Applications not affected: Max Media Manager v0.1.x - v0.3.x
Versions affected:         <= 2.0.8
Versions not affected:     >= 2.0.8-pr1
========================================================================


========================================================================
Vulnerability:  HTML injection / Cross-site scripting
========================================================================

Description
-----------
Some scripts inside the admin interface were displaying parameters
collected by the delivery scripts without proper sanitizing or escaping.
The delivery scripts have public access, while the admin interface is
restricted to logged in users. An attacker could inject HTML/XSS code
which could be displayed/executed in a later time inside the admin
interface.


Solutions
---------
- Upgrade to phpAdsNew or phpPgAds 2.0.8-pr1.



Contact informations
====================

The security contact for phpAdsNew and phpPgAds can be reached at:
<security AT phpadsnew DOT com>


Best regards
-- 
Matteo Beccati
http://phpadsnew.com
http://phppgads.com

Powered by blists - more mailing lists