<<< Date Index >>>     <<< Thread Index >>>

Re: phpAdsNew 2.0.7 Remote File Include



Hi,

I've been recently pointed to this vulnerability report by a friend. I'm not 
subscribed to Bugtraq myself and I beg pardon for being a bit late, but the 
vulnerability hasn't been reported to the vendor.

Luckily enough there's no real danger because the vulnerabilites reported are 
fakes.

Moreover phpAdsNew 2.0.7 was released more than a year ago, and the project has 
now a new name, Openads.

All of the disclosed vulnerabilities try to use global variables in includes 
inside functions, which either have no access to the reported global variables 
or aren't called if the script is directly accessed.

For reference, phpAdsNew 2.0.7:
https://developer.openads.org/browser/branches/pan/tags/REL_2_0_7/libraries/lib-remotehost.inc.php#L97
https://developer.openads.org/browser/branches/pan/tags/REL_2_0_7/admin/report-index.php#L68
https://developer.openads.org/browser/branches/pan/tags/REL_2_0_7/admin/lib-gui.inc.php#L429

and Openads 2.0.11:
https://developer.openads.org/browser/tags/openads-2.0.11/libraries/lib-remotehost.inc.php#L98
https://developer.openads.org/browser/tags/openads-2.0.11/admin/report-index.php#L68
https://developer.openads.org/browser/tags/openads-2.0.11/admin/lib-gui.inc.php#L466