Description
Multiple cross-site scripting (XSS) vulnerabilities in (a) phpAdsNew and (b) phpPgAds before 2.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) certain parameters to the banner delivery module, which is not properly handled in the administrator interface, or (2) certain parameters to the login form.
References
- phpadsnew-login-banner-xss(25458) vdb-entry
- http://sourceforge.net/project/shownotes.php?release_id=404964
- 19384 third-party-advisory
- 24206 vdb-entry
- 633 third-party-advisory
- ADV-2006-1107 vdb-entry
- 17251 vdb-entry
- http://phpadsnew.com/two/nucleus/index.php?itemid=46
- 20060327 [PHPADSNEW-SA-2006-001] phpAdsNew and phpPgAds 2.0.8 fix multiple vulnerabilities mailing-list
- 24205 vdb-entry
- 1015829 vdb-entry
- 1015828 vdb-entry
- http://sourceforge.net/project/shownotes.php?release_id=404963