Openads Delivery Engine OA_Delivery_Cache_store() Function name Argument Arbitrary PHP Code Execution

high Nessus Plugin ID 34372

Synopsis

The remote web server contains a PHP application that allows injection of arbitrary PHP commands.

Description

The remote host is running Openads, an open source ad serving application written in PHP.

The installed version of Openads contains a vulnerability in its delivery engine in that it fails to properly sanitize input to the 'name' argument of the 'OA_Delivery_Cache_store()' function in various scripts under 'www/delivery' before saving it in a cache file. An unauthenticated, remote attacker can exploit this issue to inject arbitrary PHP code and then execute it on the remote host, subject to the privileges under which the web server operates.

Solution

Upgrade to Openads 2.4.3 or later.

See Also

https://www.securityfocus.com/archive/1/archive/1/487486/100/0/threaded

Plugin Details

Severity: High

ID: 34372

File Name: openads_delivery_engine_cmd_injection.nasl

Version: 1.17

Type: remote

Family: CGI abuses

Published: 10/9/2008

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.0

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

Required KB Items: www/PHP

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Ease: No exploit is required

Exploited by Nessus: true

Exploitable With

CANVAS (CANVAS)

Reference Information

CVE: CVE-2008-0635

BID: 27603

CWE: 94

SECUNIA: 28790