OpenX Arbitrary File Upload Vulnerability

OpenX is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to adequately validate user-supplied input. An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate...

OpenX Detection

The script sends a connection request to the server and attempts to extract the version number from the reply. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifie...

Executing arbitrary PHP code on OpenX <= 2.8.1

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, OpenX adserver version 2.8.1 and lower is vulnerable to remote code execution. To be exploited, this vulnerability requires banner / file upload permissions, such as granted to the 'advertiser' and 'administrator' roles. This vulnerability is...

New vulnerabilities in OpenX

Hello 3APA3A! I want to warn you about Denial of Service, Cross-Site Scripting and Redirector vulnerabilities in OpenX. DoS Looped DoS: http://site/adclick.php About Looped DoS I wrote in my classification of DoS vulnerabilities in web applications http://websecurity.com.ua/2663/. Vulnerable are...

Vulnerabilities in OpenX

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Full path disclosure, Cross-Site Scripting и Redirector уязвимостях в OpenX. Full path disclosure: http://site/openx/www/delivery/fc.php?MAXtype=1 XSS: http://site/openx/www/delivery/fc.php?MAXtype=3Cscript3Ealertdocument.cookie3C/script3E XSS обх...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. OpenX: crossite scripting, information leak...

Code Execution vulnerability in Openads

Здравствуйте 3APA3A! Сообщаю вам о найденной мною Code Execution уязвимости в Openads. В Openads есть возможность загружать скрипты, в частности php. Что приводит к Code Execution уязвимости в том числе возможен shell upload. При загрузке баннера не проверяется его расширение. В последних версиях...

OpenX 2.6.4 multiple vulnerabilities

OpenX multiple vulnerabilities An advisory by EnableSecurity in collaboration with Acunetix. Advisory URL: http://resources.enablesecurity.com/advisories/openx-2.6.4-multiple.txt Version: OpenX 2.6.4 and older versions Description: OpenX is an online advertising web application written in PHP tha...

[OPENX-SA-2009-002] OpenX 2.4.11, 2.6.5, 2.8.0 fix multiple vulnerabilities

======================================================================== OpenX security advisory OPENX-SA-2009-002 ------------------------------------------------------------------------ Advisory ID: OPENX-SA-2009-002 Date: 2009-Apr-01 Security risk: Critical Applications affetced: OpenX Version...

OpenX SQL Injection / XSS / File Deletion

OpenX multiple vulnerabilities An advisory by EnableSecurity in collaboration with Acunetix. Advisory URL: http://resources.enablesecurity.com/advisories/openx-2.6.4-multiple.txt Version: OpenX 2.6.4 and older versions Description: OpenX is an online advertising web application written in PHP tha...

CVE-2008-6163

SQL injection vulnerability in www/delivery/ac.php in OpenX 2.6.1 allows remote attackers to execute arbitrary SQL commands via the bannerid parameter...

Sql injection

SQL injection vulnerability in www/delivery/ac.php in OpenX 2.6.1 allows remote attackers to execute arbitrary SQL commands via the bannerid parameter...

CVE-2008-6163

OpenX (v2.6.1) OpenX ac.php bannerid Parameter SQL Injection: the bannerid input is used directly in SQL queries without validation, enabling remote attackers to manipulate queries and potentially access sensitive data or execute arbitrary PHP code. Affected component: www/delivery/ac.php. Root c...

CVE-2008-6163

SQL injection vulnerability in www/delivery/ac.php in OpenX 2.6.1 allows remote attackers to execute arbitrary SQL commands via the bannerid parameter...

OpenX fc.php MAX_type Parameter Traversal Local File Inclusion

The remote host is running OpenX formerly Openads, an open source ad serving application written in PHP. The installed version of OpenX does not validate user-supplied input to the 'MAXtype' parameter of the 'www/delivery/fc.php' script before using it in a PHP 'include' function. Regardless of...

OpenX 2.6.3 - Local File Inclusion

I have found a local file inclusion exploit in OpenX 2.6.3, this is in the script "fc.php", located in /www/delivery/ Here is a snip of the code: snip includeonce '../../init-delivery.php'; $MAXPLUGINSADPLUGINNAME = 'MAXtype'; if!isset$GET$MAXPLUGINSADPLUGINNAME echo $MAXPLUGINSADPLUGINNAME . ' i...

Secunia Research: OpenX Multiple Vulnerabilities

====================================================================== Secunia Research 27/01/2009 - OpenX Multiple Vulnerabilities - ====================================================================== Table of Contents Affected Software....................................................1...

CVE-2009-0291

Directory traversal vulnerability in fc.php in OpenX 2.6.3 allows remote attackers to include and execute arbitrary files via a .. dot dot in the MAXtype parameter...

Directory traversal

Directory traversal vulnerability in fc.php in OpenX 2.6.3 allows remote attackers to include and execute arbitrary files via a .. dot dot in the MAXtype parameter...

CVE-2009-0291

OpenX 2.6.3 is affected by a Local File Inclusion in fc.php via the MAX_type parameter. The issue arises because the MAX_type input is used in a PHP include() without proper validation, enabling an unauthenticated attacker to view arbitrary files or potentially execute PHP code under the web serv...