PT-2020-7483 · Openx · Openx Adserver

Kurt Seifried + 1 · Published 2020-02-14 · Updated 2020-02-19 · CVE-2013-4211

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: OpenX Ad Server version 2.8.10

Description: A code execution issue exists due to a backdoor in the flowplayer-3.1.1.min.js library, potentially allowing a remote malicious user to execute arbitrary PHP code.

Recommendations: For OpenX Ad Server version 2.8.10, consider removing or disabling the flowplayer-3.1.1.min.js library to prevent exploitation until a patch is available.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2013-4211

Affected Products

Openx Adserver

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/openx_backdoor_php.rb · Exploit
• 🔥 https://exploit-db.com/exploits/27529 · Exploit
• 🔥 https://packetstormsecurity.com/files/cve/CVE-2013-4211 · Exploit
• 🔥 http://exploit-db.com/exploits/27529 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-4211 · Security Note
• http://securityfocus.com/bid/61650 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/86259 · Note
• http://openwall.com/lists/oss-security/2013/08/07/2 · Note