Bug #18553: phpinfo() allows cross-site scripting
| From: | olegpro at operamail dot com | Date: | Thu, 25 Jul 2002 00:52:17 +0000 |
| Subject: | Bug #18553: phpinfo() allows cross-site scripting | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-15109@lists.php.net to get a copy of this message | ||
From: olegpro@operamail.com
Operating system: Win'2k
PHP version: 4.2.2
PHP Bug Type: Feature/Change Request
Bug description: phpinfo() allows cross-site scripting
Hi!
phpinfo() is vulnerable to cross-site scripting.
printing of _SERVER["argv"] of is vulnerable.
// phpinfo.php
<?
phpinfo();
?>
http://localhost/phpinfo.php?z=<SCRIPT>alert('Hello
world!');</SCRIPT>
--
Edit bug report at http://bugs.php.net/?id=18553&edit=1
--
Fixed in CVS: http://bugs.php.net/fix.php?id=18553&r=fixedcvs
Fixed in release: http://bugs.php.net/fix.php?id=18553&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=18553&r=needtrace
Try newer version: http://bugs.php.net/fix.php?id=18553&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=18553&r=support
Expected behavior: http://bugs.php.net/fix.php?id=18553&r=notwrong
Not enough info: http://bugs.php.net/fix.php?id=18553&r=notenoughinfo
Submitted twice: http://bugs.php.net/fix.php?id=18553&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=18553&r=globals