3 ms·

I got bitten by this too, and when I discovered why I was livid. https://svn.openx.org/openx/tags/2.8/openx-2.8.6/plugins_repo/openXVideoAds/www/admin/plugins/

I got bitten by this too, and when I discovered why I was livid. https://svn.openx.org/openx/tags/2.8/openx-2.8.6/plugins_repo/openXVideoAds/www/admin/plugins/videoReport/lib/ofc2/ofc_upload_image.php https://svn.openx.org/openx/tags/2.8/openx-2.8.6/plugins_rep... This third party plugin is automatically installed and enabled by the installer. No admin authentication, wide open access to upload and run PHP. More details can be found at http://www.kreativrauschen.com/blog/2010/09/09/critical-vulnerability-in-openx-286-open-flash-chart-2/ http://www.kreativrauschen.com/blog/2010/09/09/critical-vuln... and if www/admin/plugins/videoReport/lib/tmp-upload-images/ exists, it's likely your server has been compromised.

johng 16y ago
What version did this vulnerability first appear? I have some older installs that don't have an admin/plugins folder.
DJN 16y ago
Dude, if u need a decent ad server as an alternative to OpenX, I'll suggest. Trafficspaces. I designed it and it's one of my proudest pieces of work (if I may say so myself) :) Warning: its a premium service http://www.trafficspaces.com/tour/ http://www.trafficspaces.com/tour/
- johng 16y ago
  Looks neat but $99/month for 1M impressions ain't much. Overpriced IMHO. Assuming $1 CPM, a site will be making $1000 off of that. Your taking a 10% cut. $100 should get you 50,000,000 impressions, at minimum.
  - DJN 16y ago
    Think about it this way, if you can segment your traffic into valuable niches (e.g females, 18-30 in NYC, who are searching for shoes), you can sell your traffic at a far higher CPM. That's where Trafficspaces excels - ad targeting. All impressions aren't equal so you shouldn't treat them as such. The key is being able to unlock the value.