PT-2007-1946 · Phpadsnew · Openads

Published 2007-01-25 · Updated 2024-08-07 · CVE-2007-0486

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Openads (aka phpAdsNew) version 2.0.7

Description Multiple PHP remote file inclusion issues allow remote attackers to execute arbitrary PHP code via a URL in the (1) phpAds geoPlugin parameter to "libraries/lib-remotehost.inc", the (2) filename parameter to "admin/report-index", or the (3) phpAds config[my footer] parameter to "admin/lib-gui.inc". The vendor has disputed this issue, stating that the relevant variables are used within function definitions.

Recommendations For Openads (aka phpAdsNew) version 2.0.7, consider disabling the phpAds geoPlugin, filename, and phpAds config[my footer] parameters to prevent exploitation until a patch is available. Restrict access to the "libraries/lib-remotehost.inc", "admin/report-index", and "admin/lib-gui.inc" files to minimize the risk of exploitation. Avoid using the phpAds geoPlugin, filename, and phpAds config[my footer] parameters in the affected API endpoints until the issue is resolved.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2007-0486

Affected Products

Openads

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2007-0486 · Security Note
• http://securityfocus.com/bid/22172 · Note
• http://securityfocus.com/archive/1/457670/100/0/threaded · Note
• http://securityfocus.com/archive/1/457806/100/200/threaded · Note
• https://t.me/cvenotify/89626 · Telegram Post
• http://securityfocus.com/archive/1/457991/100/200/threaded · Note
• http://securityreason.com/securityalert/2174 · Note
• http://osvdb.org/33573 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0486 · Note