Full Disclosure mailing list archives
Re: Re: Advisory 18/2005: PHP Cross Site Scripting (XSS) Vulnerability in phpinfo()
From: Florian Weimer <fw () deneb enyo de>
Date: Mon, 31 Oct 2005 20:45:55 +0100
* Matthew Murphy:
Nice try, Stefan. I reported this vulnerability more than three years ago (against 4.2.x) on October 12, 2002 via the PHP bug database. I was told to implement an .ini setting and the bug was marked "Bogus". For information, please see PHP Bug #19881: http://bugs.php.net/bug.php?id=19881
For the record, Matthew's bug is CVE-2002-1954, and it appears to be unfixed. An URL which works with Internet Explorer against PHP 5.0.5 is: http://localhost/test.php/"</img><script>alert();</script> This causes the passed JavaScript to be embedded into the PHP logo reference. Matthew's original exploit does not work anymore due to changes in the way requests are handled by Apache or PHP. However, it exposes an issue further down in the phpinfo output, which is triggered by Matthew's original URL: http://localhost/test.php?"><SCRIPT>alert(document.URL)</SCRIPT>=x There is not sufficent public information to tell which bug of the two is Stefan's. I'm not sure if the second URL qualifies as "stacked array assignment", so maybe Stefan discovered yet another problem. PS: Firefox %-encodes the URLs before sending them to the server, so these URLs do not work with that browser. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Advisory 18/2005: PHP Cross Site Scripting (XSS) Vulnerability in phpinfo() Stefan Esser (Oct 31)
- Re: Advisory 18/2005: PHP Cross Site Scripting (XSS) Vulnerability in phpinfo() Matthew Murphy (Oct 31)
- Message not available
- Re: Advisory 18/2005: PHP Cross Site Scripting (XSS) Vulnerability in phpinfo() Matthew Murphy (Oct 31)
- Re: Re: Advisory 18/2005: PHP Cross Site Scripting (XSS) Vulnerability in phpinfo() Stefan Esser (Oct 31)
- Re: Re: Advisory 18/2005: PHP Cross Site Scripting (XSS) Vulnerability in phpinfo() Florian Weimer (Oct 31)
- Re: Advisory 18/2005: PHP Cross Site Scripting (XSS) Vulnerability in phpinfo() Matthew Murphy (Oct 31)
- Message not available
- Re: Advisory 18/2005: PHP Cross Site Scripting (XSS) Vulnerability in phpinfo() Matthew Murphy (Oct 31)
- Re: Re: Advisory 18/2005: PHP Cross Site Scripting (XSS) Vulnerability in phpinfo() Florian Weimer (Oct 31)