CVE-2005-0791 in phpAdsNew
Summary
by MITRE
Cross-site scripting (XSS) vulnerability in adframe.php in phpAdsNew 2.0.4-pr1, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the refresh parameter.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2025
The vulnerability identified as CVE-2005-0791 represents a critical cross-site scripting flaw within the phpAdsNew advertising platform version 2.0.4-pr1. This security weakness specifically affects systems where the PHP configuration parameter register_globals is enabled, creating a dangerous condition that enables malicious actors to execute unauthorized code within the context of user browsers. The vulnerability is located in the adframe.php script which serves as a core component for displaying advertisements and managing ad delivery mechanisms within the phpAdsNew framework.
The technical exploitation of this vulnerability occurs through manipulation of the refresh parameter within the adframe.php script. When register_globals is enabled, PHP automatically creates global variables from request data, including GET and POST parameters. This configuration flaw allows attackers to inject malicious scripts directly through the refresh parameter, bypassing normal input validation mechanisms. The vulnerability stems from insufficient sanitization of user-supplied input before it is rendered in the web page context, creating an environment where arbitrary HTML and JavaScript code can be executed in the victim's browser session.
The operational impact of this vulnerability extends beyond simple script injection, as it provides attackers with the capability to perform session hijacking, defacement of advertising content, and potential data exfiltration from users interacting with compromised advertisements. Attackers can craft malicious URLs that, when clicked by unsuspecting users, execute scripts that steal cookies, redirect users to malicious sites, or modify the advertising interface to display fraudulent content. This vulnerability particularly affects web publishers and advertisers who rely on phpAdsNew for their advertising infrastructure, potentially compromising the integrity of their advertising campaigns and user data.
From a cybersecurity framework perspective, this vulnerability maps directly to CWE-79: Improper Neutralization of Input During Web Page Generation, which addresses the failure to properly sanitize user input before incorporating it into web pages. The attack vector aligns with ATT&CK technique T1566.001: Phishing via Social Engineering, as attackers can create convincing malicious advertisements that appear legitimate to end users. The vulnerability also demonstrates characteristics of T1059.007: Command and Scripting Interpreter: JavaScript, as the attack specifically targets JavaScript execution within browser contexts. Organizations using phpAdsNew should implement immediate mitigations including disabling register_globals in PHP configuration, implementing comprehensive input validation and output encoding, and applying the latest security patches from the phpAdsNew development team to address this persistent vulnerability that could have been prevented through proper secure coding practices and configuration management.