phpAdsNew is "a banner management and tracking system written in PHP". Multiple security vulnerabilities in phpAdsNew allow remote attackers to disclose the true path under which the product was installed, and to cause the program to execute arbitrary SQL statements.
Full Path Disclosure in create.php:
If user can access the misc/revisions/create.php, the script will echo the whole installation path to the user:
"Starting scan at /var/www/mysite/html/ads"
If the revision script completes successfully, the user can then try to access libraries/defaults/revisions.txt, which will then reveal all files and their revisions and hashes, thus furthermore revealing all files that have been manually modified by the site admin.
The revisions.txt will also reveal any file that has been added under the installation tree, unless it's hidden (starts with '.')
Full Path Disclosures in the following files (Just by accessing with browser):
admin/lib-updates.inc.php
admin/lib-targetstats.inc.php
admin/lib-size.inc.php
admin/lib-misc-stats.inc.php
admin/lib-hourly-hosts.inc.php
admin/lib-hourly.inc.php
admin/lib-history.inc.php
admin/graph-daily.php
SQL-injection in logout.php / lib-sessions.inc.php:
phpAdsNew doesn't properly validate the sessionID it receives from cookie when it tries to log out the user. And it doesn't even check if the user if really logged in in the first place, thus allowing unauthorized users to feed data into the SQL-query that's supposed to clean the phpads_session -table. Take into note though that this requires magic_quotes_gpc to be off.
Impact:
A remote attacker could exploit this to learn installation paths on server, as well as to locate new files and possible manually modified files.
If magic_quotes_gpc is off, a remote attacker can also compromise the integrity of the database.
