PT-2005-1820 · Phpadsnew · Phpadsnew

Cxib8O3 + 1 · Published 2005-03-14 · Updated 2017-07-11 · CVE-2005-0791

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpAdsNew version 2.0.4-pr1

Description The issue is related to a cross-site scripting (XSS) vulnerability. This occurs when an attacker can inject arbitrary web script or HTML into a website, potentially allowing them to steal user data or take control of the user's session. The vulnerability is specifically in the adframe.php file and can be exploited when the register globals setting is enabled. The refresh parameter is the vulnerable point of entry for this attack.

Recommendations For phpAdsNew version 2.0.4-pr1, consider disabling the register globals setting to prevent exploitation. Additionally, restrict access to the adframe.php file and avoid using the refresh parameter until a fix is available.

Exploit

Fix

Related Identifiers

CVE-2005-0791

Affected Products

Phpadsnew

References · 10

• 🔥 https://exploit-db.com/exploits/25225 · Exploit
• http://secunia.com/advisories/14592 · Vendor Advisory
• http://securityreason.com/adv/%5BphpAdsNew%202.0.4-pr1%20Multiple%20vulnerabilities%20cXIb8O3.9%5D.asc · Vendor Advisory
• http://securityfocus.com/bid/12803 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0791 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19692 · Note
• http://osvdb.org/14787 · Note
• http://securitytracker.com/id?1013429 · Note
• http://marc.info/?l=bugtraq&m=111083286926490&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0791 · Note