| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: 24 Jan 2007 17:40:55 -0000 From: matteo@...cati.com To: bugtraq@...urityfocus.com Subject: Re: phpAdsNew 2.0.7 Remote File Include Hi, I've been recently pointed to this vulnerability report by a friend. I'm not subscribed to Bugtraq myself and I beg pardon for being a bit late, but the vulnerability hasn't been reported to the vendor. Luckily enough there's no real danger because the vulnerabilites reported are fakes. Moreover phpAdsNew 2.0.7 was released more than a year ago, and the project has now a new name, Openads. All of the disclosed vulnerabilities try to use global variables in includes inside functions, which either have no access to the reported global variables or aren't called if the script is directly accessed. For reference, phpAdsNew 2.0.7: https://developer.openads.org/browser/branches/pan/tags/REL_2_0_7/libraries/lib-remotehost.inc.php#L97 https://developer.openads.org/browser/branches/pan/tags/REL_2_0_7/admin/report-index.php#L68 https://developer.openads.org/browser/branches/pan/tags/REL_2_0_7/admin/lib-gui.inc.php#L429 and Openads 2.0.11: https://developer.openads.org/browser/tags/openads-2.0.11/libraries/lib-remotehost.inc.php#L98 https://developer.openads.org/browser/tags/openads-2.0.11/admin/report-index.php#L68 https://developer.openads.org/browser/tags/openads-2.0.11/admin/lib-gui.inc.php#L466
Powered by blists - more mailing lists