CVE-2005-3646

Multiple SQL injection vulnerabilities in lib-sessions.inc.php in phpAdsNew and phpPgAds 2.0.6 and possibly earlier versions allow remote attackers to execute arbitrary SQL commands via the sessionID parameter in 1 logout.php and 2 index.php...

CVE-2005-3645

CVE-2005-3645 affects phpAdsNew and phpPgAds 2.0.6 and possibly earlier versions. The issue allows remote disclosure of the application installation path and other sensitive information via direct requests to create.php, and (if display_errors is enabled) to lib-updates.inc.php, lib-targetstats.i...

CVE-2005-3646

CVE-2005-3646 concerns multiple SQL injection flaws in lib-sessions.inc.php of phpAdsNew and phpPgAds 2.0.6 (and earlier) . The vulnerabilities allow remoto attackers to inject SQL via the sessionID parameter in both logout.php and index.php . The issue is documented with a high impact (CVSS base...

CVE-2005-3645: Exposure of Sensitive Information to an Unauthorized Actor

phpAdsNew and phpPgAds 2.0.6 and possibly earlier versions allows remote attackers to obtain the application installation path and other sensitive information via direct requests to 1 create.php, and if displayerrors is enabled, 2 lib-updates.inc.php, 3 lib-targetstats.inc.php, 4 lib-size.inc.php...

ZRCSA-200502 - phpAdsNew SQL Injection Vulnerabilities

ZRCSA-200502 - phpAdsNew SQL Injection Vulnerabilities Zone-H Research Center Security Advisory 200502 http://www.zone-h.fr Date of release: 11/11/2005 Software: phpAdsNew www.phpadsnew.com Affected versions: = 2.0.6 2.0.7rc1 latest CVS snapshot Risk: Medium Discovered by: Kevin Fernandez...

ZH200502.txt

Zone-H Research Center Security Advisory 200502 http://www.zone-h.fr Date of release: 11/11/2005 Software: phpAdsNew www.phpadsnew.com Affected versions: = 2.0.6 2.0.7rc1 latest CVS snapshot Risk: Medium Discovered by: Kevin Fernandez "Siegfried" from the Zone-H Research Team Background from thei...

phpAdsNew XML-RPC Library Remote Code Injection

The remote host appears to be running phpAdsNew, an open source ad server written in PHP. The version of phpAdsNew installed on the remote host allows attackers to execute arbitrary PHP code subject to the privileges of the web server user id due to a flaw in its bundled XML-RPC library...

[FS-05-01] Multiple vulnerabilities in phpAdsNew

Security Advisory http://www.fitsec.com/advisories Severity: Low/Medium Title: Multiple vulnerabilities in phpAdsNew Date: 10.11.2005 ID: FS-05-01 Author: Toni Koivunen toni.koivunen at fitsec.com - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis: phpAdsNew has a pa...

phpAdsNew Multiple Vulnerabilities (Mar 2005) - Active Check

phpAdsNew is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2005 Noam Rathaus Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

phpAdsNew / phpPgAds < 2.0.6 Multiple Vulnerabilities

The remote host is running phpAdsNew / phpPgAds, an open source banner ad server. The version of phpAdsNews / phpPgAds installed on the remote host suffers from several flaws : - Remote PHP Code Injection Vulnerability The XML-RPC library bundled with the application allows an attacker to inject...

CVE-2005-2635

Multiple directory traversal vulnerabilities in phpAdsNew and phpPgAds before 2.0.6 allow remote attackers to include arbitrary files via a .. dot dot in the 1 layerstyle parameter to adlayer.php or 2 language parameter to js-form.php...

CVE-2005-2636

SQL injection vulnerability in lib-view-direct.inc.php in phpAdsNew and phpPgAds before 2.0.6 allows remote attackers to execute arbitrary SQL commands via the clientid parameter...

CVE-2005-2636

SQL injection vulnerability in lib-view-direct.inc.php in phpAdsNew and phpPgAds before 2.0.6 allows remote attackers to execute arbitrary SQL commands via the clientid parameter...

CVE-2005-2636

The CVE-2005-2636 issue affects phpAdsNew/phpPgAds prior to version 2.0.6, where the libraries/lib-view-direct.inc.php clientid parameter enables SQL injection. This allows remote attackers to execute arbitrary SQL commands against the backend. The only concrete detail available is that the vulne...

CVE-2005-2635

Multiple directory traversal vulnerabilities in phpAdsNew and phpPgAds before 2.0.6 allow remote attackers to include arbitrary files via a .. dot dot in the 1 layerstyle parameter to adlayer.php or 2 language parameter to js-form.php...

CVE-2005-2635

CVE-2005-2635 affects phpAdsNew/phpPgAds prior to 2.0.6. The vulnerabilities are directory traversal / local file inclusion via unsanitized user input: the layerstyle parameter to adlayer.php and the language parameter to admin/js-form.php. Root cause is improper input validation used to include ...

CVE-2005-2635: Undefined Security Weakness

Multiple directory traversal vulnerabilities in phpAdsNew and phpPgAds before 2.0.6 allow remote attackers to include arbitrary files via a .. dot dot in the 1 layerstyle parameter to adlayer.php or 2 language parameter to js-form.php...

CVE-2005-2636: Undefined Security Weakness

SQL injection vulnerability in lib-view-direct.inc.php in phpAdsNew and phpPgAds before 2.0.6 allows remote attackers to execute arbitrary SQL commands via the clientid parameter...

security flaw

Eval injection vulnerability in PHPXMLRPC 1.1.1 and earlier PEAR XML-RPC for PHP, as used in multiple products including 1 Drupal, 2 phpAdsNew, 3 phpPgAds, and 4 phpgroupware, allows remote attackers to execute arbitrary PHP code via certain nested XML tags in a PHP document that should not be...

phpAdsNew205.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 phpAdsNew/phpPgAds 2.0.5 Local file inclusion cXIb8O3.16 Author: Maksymilian Arciemowicz cXIb8O3 from SECURITYREASON.COM TEAM Date: 14.07.2005 01:54 GMT+01.00 - --- 0.Description --- phpAdsNew is an open-source ad server, with an integrated banner...