Detections
Analytics
Openads Delivery Engine OA_Delivery_Cache_store() Function name Argument Arbitrary PHP Code Execution
high Nessus Plugin ID 34372
Language:
Synopsis
The remote web server contains a PHP application that allows injection of arbitrary PHP commands.Description
The remote host is running Openads, an open source ad serving application written in PHP.The installed version of Openads contains a vulnerability in its delivery engine in that it fails to properly sanitize input to the 'name' argument of the 'OA_Delivery_Cache_store()' function in various scripts under 'www/delivery' before saving it in a cache file. An unauthenticated, remote attacker can exploit this issue to inject arbitrary PHP code and then execute it on the remote host, subject to the privileges under which the web server operates.
Solution
Upgrade to Openads 2.4.3 or later.See Also
https://www.securityfocus.com/archive/1/archive/1/487486/100/0/threaded
Plugin Details
Severity: High
ID: 34372
File Name: openads_delivery_engine_cmd_injection.nasl
Version: 1.17
Type: remote
Family: CGI abuses
Published: 10/9/2008
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.0
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.2
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
Required KB Items: www/PHP
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No exploit is required
Exploited by Nessus: true
Exploitable With
CANVAS (CANVAS)
Reference Information
CVE: CVE-2008-0635
BID: 27603