Adcycle AdLibrary.pm Session Access Vulnerability

Adcycle is a package of perl scripts available from Adcycle.com. The scripts are designed to manage banner ad rotation through a web interface, backended with a MySQL database.

A problem with the suite could allow remote execution of commands. The handling of input by the script may allow users to gain access to the accounts of other users that are currently logged in. By generating a custom crafted request and appending it to the adcenter.cgi script, a user would be able to fill the values needed to get access to the system, and execute commands as a user already logged into the system.

This makes it possible for a malicious to gain access to database resources and execute arbitrary commands. It may also be possible for a user to gain elevated privileges on the database.


 

Privacy Statement
Copyright 2010, SecurityFocus