phpAdsNew and phpPgAds 2.0.8-pr1 fix XSS vulnerability

Risk: Low
Local: No
Remote: Yes

CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

======================================================================== phpAdsNew / phpPgAds security advisory PHPADSNEW-SA-2006-002 ------------------------------------------------------------------------ Advisory ID: PHPADSNEW-SA-2006-002 Date: 2006-Oct-28 Security risk: medium risk Applications affected: phpAdsNew, phpPgAds Applications not affected: Max Media Manager v0.1.x - v0.3.x Versions affected: <= 2.0.8 Versions not affected: >= 2.0.8-pr1 ======================================================================== ======================================================================== Vulnerability: HTML injection / Cross-site scripting ======================================================================== Description ----------- Some scripts inside the admin interface were displaying parameters collected by the delivery scripts without proper sanitizing or escaping. The delivery scripts have public access, while the admin interface is restricted to logged in users. An attacker could inject HTML/XSS code which could be displayed/executed in a later time inside the admin interface. Solutions --------- - Upgrade to phpAdsNew or phpPgAds 2.0.8-pr1. Contact informations ==================== The security contact for phpAdsNew and phpPgAds can be reached at: <security AT phpadsnew DOT com> Best regards -- Matteo Beccati

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2023,


Back to Top