[Full-disclosure] [OPENADS-SA-2007-002] Max Media Manager v0.1.29 and v0.3.30 vulnerability fixed

========================================================================
Openads security advisory OPENADS-SA-2007-002
------------------------------------------------------------------------
Advisory ID: OPENADS-SA-2007-002
Date: 2007-Jan-25
Security risk: low risk
Applications affetced: Max Media Manager
Versions affected: <= Max Media Manager v0.1.29-rc and v0.3.30-alpha
Versions not affected: >= Max Media Manager v0.3.31-alpha-pr2
========================================================================


========================================================================
Vulnerability: Cross-site scripting
========================================================================

Description
-----------
This is the description of the vulnerability recieved by JPCERT:

"We have confirmed that in admin-search.php, scripts included in
'keyword' parameter is shown without proper sanitization thus the
script could be executed.

However a user needs to login the system as administrator, which makes
the exploit technically difficult.

If this vulnerability is exploited, by script execution, a user's
session ID included in HTTP Cookie might be stolen. Also there's a risk
that the contents of phpAdsNew are falsified temporarily."

Note: Max Media Manager is derived from phpAdsNew and was affected by
the same vulnerability. MMM v0.3.30-alpha also has affiliate-search.php
which was vulnerable as well.


References
----------
- JVN#07274813: http://jvn.jp/jp/JVN%2307274813/index.html


Solution
--------
- If you are running v0.3.x, upgrade to v0.3.30-alpha-pr2
- If you are running v0.1.x, a patch is available here:

https://developer.openads.org/changeset/3919?format=zip&new=3919


Contact informations
====================

The security contact for Openads can be reached at:
<security AT openads DOT org>


Best regards
--
Matteo Beccati
http://www.openads.org
http://phpadsnew.com
http://phppgads.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • SecurityFocus Microsoft Newsletter #83
    ... MICROSOFT VULNERABILITY SUMMARY ... Microsoft IIS CodeBrws.ASP Source Code Disclosure Vulnerability ... Microsoft Internet Explorer History List Script Injection ... Microsoft Windows 2000 Lanman Denial of Service Vulnerability ...
    (Focus-Microsoft)
  • SecurityFocus Microsoft Newsletter #84
    ... The most critical piece of vulnerability assessment is remediation. ... MICROSOFT VULNERABILITY SUMMARY ... IcrediBB Script Injection Vulnerability ... WorkforceROI XPede Unprotected Administrative Facilities... ...
    (Focus-Microsoft)
  • SecurityFocus Microsoft Newsletter #91
    ... SecurityFocus Microsoft Newsletter #91 ... Multiple Bugzilla Security Vulnerabilities ... Geeklog pid CGI Variable SQL Injection Vulnerability ... Geeklog Calendar Event Form Script Injection Vulnerability ...
    (Focus-Microsoft)
  • SecurityFocus Microsoft Newsletter #109
    ... MICROSOFT VULNERABILITY SUMMARY ... PHPRank Banner Script Code Injection Vulnerability ... PHPNuke Multiple Script Code Filtering Vulnerabilities ...
    (Focus-Microsoft)
  • HP Web JetAdmin vulnerabilities.
    ... this vulnerability is not a critical risk. ... Luckily these directories do not have execute permissions but, this script, ... create files in the Administrators startup folder. ... it may be possible to directly inject the hts scripting ...
    (Bugtraq)