PT-2005-3525 · Phpadsnew · Phppgads+1

Maksymilian Arciemowicz · Published 2005-08-20 · Updated 2017-07-11 · CVE-2005-2635

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpAdsNew versions prior to 2.0.6 phpPgAds versions prior to 2.0.6

Description The issue allows remote attackers to include arbitrary files due to multiple directory traversal vulnerabilities. This can be achieved by including a .. (dot dot) in the layerstyle parameter to "adlayer.php" or the language parameter to "js-form.php".

Recommendations For phpAdsNew versions prior to 2.0.6, update to version 2.0.6 or later. For phpPgAds versions prior to 2.0.6, update to version 2.0.6 or later. As a temporary workaround, consider restricting access to the "adlayer.php" and "js-form.php" files until a patch is available. Avoid using the layerstyle and language parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2005-2635

Affected Products

Phpadsnew

Phppgads

References · 7

• 🔥 http://securityreason.com/adv/phpAdsnew.SR.16.asc · Exploit
• http://securityfocus.com/bid/14584 · Patch
• http://secunia.com/advisories/16469 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2635 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2635 · Note
• http://marc.info/?l=bugtraq&m=112431497300344&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/21880 · Note