Latest from our blog
SQL Injection in mAdserve
|Vulnerable Versions:||2.0 and probably prior|
|Advisory Publication:||March 26, 2014 [without technical details]|
|Vendor Notification:||March 26, 2014|
|Public Disclosure:||April 16, 2014|
|Latest Update:||April 16, 2014|
|Vulnerability Type:||SQL Injection [CWE-89]|
|CVSSv2 Base Score:||6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)|
|Solution Status:||Solution Available|
|Discovered and Provided:||High-Tech Bridge Security Research Lab|
High-Tech Bridge Security Research Lab discovered multiple SQL injection vulnerabilities in mAdserve, which can be exploited to execute arbitrary SQL commands in application’s database and compromise vulnerable website.
|Vendor did not reply to 3 notifications by email, 3 notifications via contact form, 1 notification via twitter. Currently we are not aware of any official solution for this vulnerability.|
Unofficial patch was developed by High-Tech Bridge Security Research Lab and is available here: https://www.htbridge.com/advisory/HTB23209-patch.zip
| High-Tech Bridge Advisory HTB23209 - https://www.htbridge.com/advisory/HTB23209 - SQL Injection in mAdserve.|
 mAdserve - http://www.madserve.org/ - The Open Source Mobile Ad Server for Publishers.
 Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
 Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
 ImmuniWeb® SaaS - hybrid of manual web application penetration test and cutting-edge vulnerability scanner available online via a Software-as-a-Service (SaaS) model.
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.