========================================================================
phpAdsNew / phpPgAds security advisory PHPADSNEW-SA-2005-001

Advisory ID: PHPADSNEW-SA-2005-001
Date: 2005-Aug-17
Security risk: highly critical
Applications affetced: phpAdsNew, phpPgAds
Versions affected: <= 2.0.5
Versions not affected: >= 2.0.6

========================================================================
Vulnerability 1: arbitrary PHP code execution

Impact: system access
Where: from remote

Description

Stefan Esser of the Hardened-PHP Project reported a serious
vulnerablility in the third-party XML-RPC library included with
phpAdsNew and phpPgAds. An attacker could execute arbitrary PHP code on
a vulnerable site.

Solution

• Upgrade to phpAdsNew or phpPgAds 2.0.6.

References

http://www.hardened-php.net/advisory_152005.67.html

========================================================================
Vulnerability 2: local file inclusion

Impact: system access
Where: from remote

Description

Maksymilian Arciemowicz of the securityreason.com team reported a local
file inclusion vulnerablility in phpAdsNew and phpPgAds, caused by
missing sanitization of a GET variable.

Solution

• Upgrade to phpAdsNew or phpPgAds 2.0.6.

References

[phpAdsNew 2.0.5 Local file inclusion cXIb8O3.16]
http://www.securityreason.com/

========================================================================
Vulnerability 3: SQL injection

Impact: application admin access (+ potential system access)
Where: from remote

Description

Pine Digital Security reported an SQL injection vulnerablility in
phpAdsNew and phpPgAds, caused by missing sanitization of the clientid
GET variable. The vulnerability seems to be exploitable with MySQL 4.1+
or PostgreSQL to obtain administrator access to the application.
Depending on the database user permissions, an attacker could also gain
access to the local filesystem.

Solution

• Upgrade to phpAdsNew or phpPgAds 2.0.6.

References

http://www.pine.nl/

Contact informations

The security contact for phpAdsNew and phpPgAds can be reached at:
<security AT phpadsnew DOT com>

Best regards

Matteo Beccati
http://phpadsnew.com/
http://phppgads.com/