full-disclosure - Vulnerability in phpAdsNew, OpenAds and OpenX

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <004f01cac3bf$026c6af0$010000c0@ml>
Date: Sun, 14 Mar 2010 23:38:25 +0200
From: "MustLive" <mustlive@...security.com.ua>
To: <full-disclosure@...ts.grok.org.uk>
Subject: Vulnerability in phpAdsNew, OpenAds and OpenX

Hello Full-Disclosure!

I want to warn you about vulnerability in phpAdsNew, OpenAds and OpenX.

Earlier I already wrote to the list about XSS and HTML Injection
vulnerabilities in tagcloud.swf in multiple plugins for many engines such as
WordPress, Joomla and DLE. About this issue I wrote in details in my article
XSS vulnerabilities in 34 millions flash files
(http://www.webappsec.org/lists/websecurity/archive/2010-01/msg00035.html).
And before this article, I made another research and wrote another article
about holes in millions of flash banners - XSS vulnerabilities in 8 millions
flash files (http://websecurity.com.ua/3789/). Among millions of vulnerable
web sites, there are also sites which are using banner systems,
particularly phpAdsNew, OpenAds and OpenX.

-----------------------------
Advisory: Vulnerability in phpAdsNew, OpenAds and OpenX
-----------------------------
URL: http://websecurity.com.ua/3760/
-----------------------------
Timeline:

23.04.2009 - found the vulnerabilities.
11.12.2009 - announced at my site.
12.12.2009 - informed developers.
12.02.2009 - disclosed at my site.
-----------------------------
Details:

This is Cross-Site Scripting vulnerability.

The vulnerability exists in flash banners in phpAdsNew, OpenAds and OpenX
banner systems (there are a lot of web sites which are using these banner
systems with such vulnerable flash banners).

The attack is possible via parameter clickTAG (but other parameters are
possible, as I wrote in my article) in flash banners. About such
vulnerabilities I wrote in details (and gave recommendations about
protection against them) in my article XSS vulnerabilities in 8 millions
flash files.

XSS:

http://site/path/banner.swf?clickTAG=javascript:alert('XSS')

Vulnerable are all versions of phpAdsNew, OpenAds and OpenX. Developers took
this vulnerability into account (they were planning to inform users of their
banner systems about this issue). In addition to recommendations about
protection for web developers and for web sites owners (which I gave in my
article), I also gave recommendations for Internet users in my interview at
Data Security Podcast (http://websecurity.com.ua/3810/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/