Allembru Ad Manager contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'cname' parameter upon submission to the /ajax/campaigns.php script. This may allow an attacker to create a specially crafted request that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.
~.~.~.~.~.~.
PoC-Exploit
~.~.~.~.~.~.
Step1 : Login using the required credentials
Step2 : Create a New Campaign
Step3 : Insert the malicious script on field "Campaign name" and click
submit.
Step4 : Persistent Cross site script is Confirmed
Parameter used : '"--><script>alert(0x000872)</script>
Disclosure Timeline:
Vendor Informed Date :2013-01-14
Disclosure Date :2013-01-14
Exploit Publish Date :2013-01-14
