CVE-2007-2046

Multiple CRLF injection vulnerabilities in adclick.php in (a) Openads (phpAdsNew) 2.0.11 and earlier and (b) Openads for PostgreSQL (phpPgAds) 2.0.11 and earlier allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in (1) the dest parameter and (2) the Referer HTTP header. NOTE: some of these details are obtained from third party information.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://forum.openads.org/index.php?showtopic=503413399&pid=39136	Patch
http://sourceforge.net/forum/forum.php?forum_id=685278
http://sourceforge.net/project/shownotes.php?release_id=500343
http://secunia.com/advisories/24876	Patch Vendor Advisory
http://www.vupen.com/english/advisories/2007/1364

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:openads:openads::::::::
	cpe:2.3:a:openads:openads:::postgresql:::::*

Information

Published : 2007-04-16 15:19

Updated : 2011-03-07 18:53

NVD link : CVE-2007-2046

Mitre link : CVE-2007-2046

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

openads

openads

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://forum.openads.org/index.php?showtopic=503413399&pid=39136", "name": "http://forum.openads.org/index.php?showtopic=503413399&pid=39136", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://sourceforge.net/forum/forum.php?forum_id=685278", "name": "http://sourceforge.net/forum/forum.php?forum_id=685278", "tags": [], "refsource": "CONFIRM"}, {"url": "http://sourceforge.net/project/shownotes.php?release_id=500343", "name": "http://sourceforge.net/project/shownotes.php?release_id=500343", "tags": [], "refsource": "CONFIRM"}, {"url": "http://secunia.com/advisories/24876", "name": "24876", "tags": ["Patch", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.vupen.com/english/advisories/2007/1364", "name": "ADV-2007-1364", "tags": [], "refsource": "VUPEN"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple CRLF injection vulnerabilities in adclick.php in (a) Openads (phpAdsNew) 2.0.11 and earlier and (b) Openads for PostgreSQL (phpPgAds) 2.0.11 and earlier allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in (1) the dest parameter and (2) the Referer HTTP header. NOTE: some of these details are obtained from third party information."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-2046", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2007-04-16T22:19Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:openads:openads:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.0.11"}, {"cpe23Uri": "cpe:2.3:a:openads:openads:*:*:postgresql:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.0.11"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2011-03-08T02:53Z"}