The vulnerability has been exploited from November 2012 till August 2013.
Vulnerable component: Revive Adserver
CVSSv3 score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.
The weakness exists due to compromise of the source code package. A remote attacker can create a specially crafted request with a rot13'd and reversed payload and send it to the target system to execute arbitrary PHP code.
Successful exploitation of the vulnerability results in arbitrary PHP code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
- OpenX - Backdoor PHP Code Execution (Metasploit) [Exploit-DB]