PT-2007-1946 · Phpadsnew · Openads

CVE-2007-0486 · Publicado 2007-01-25 · Atualizado 2024-08-07

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Openads (aka phpAdsNew) version 2.0.7

Description Multiple PHP remote file inclusion issues allow remote attackers to execute arbitrary PHP code via a URL in the (1) phpAds geoPlugin parameter to "libraries/lib-remotehost.inc", the (2) filename parameter to "admin/report-index", or the (3) phpAds config[my footer] parameter to "admin/lib-gui.inc". The vendor has disputed this issue, stating that the relevant variables are used within function definitions.

Recommendations For Openads (aka phpAdsNew) version 2.0.7, consider disabling the phpAds geoPlugin, filename, and phpAds config[my footer] parameters to prevent exploitation until a patch is available. Restrict access to the "libraries/lib-remotehost.inc", "admin/report-index", and "admin/lib-gui.inc" files to minimize the risk of exploitation. Avoid using the phpAds geoPlugin, filename, and phpAds config[my footer] parameters in the affected API endpoints until the issue is resolved.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2007-0486

Produtos afetados

Openads

Referências · 9

• http://securityfocus.com/bid/22172 · Nota
• http://securityfocus.com/archive/1/457670/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0486 · Nota de Segurança
• http://securityfocus.com/archive/1/457806/100/200/threaded · Nota
• https://t.me/cvenotify/89626 · Publicação no Telegram
• http://securityfocus.com/archive/1/457991/100/200/threaded · Nota
• http://securityreason.com/securityalert/2174 · Nota
• http://osvdb.org/33573 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0486 · Nota