Bug #16258: Cross-Site scripting in php.net

From: nopman@hackermail.com Operating system: Unix PHP version: 4.1.2 PHP Bug Type: Website problem Bug description: Cross-Site scripting in php.net There is a Cross-Site scripting problem in source.php and search.php. One can enter following URL: http://www.php.net/source.php?url=/<script>alert(document.cookie)</script><!--.html And following will also work: http://www.php.net/search.php?show=nosource&auto=1&pattern=dfighdfughfg&base="><script>alert(document.cookie)</script><!-- Regards, NopMan -- Edit bug report at http://bugs.php.net/?id=16258&edit=1 -- Fixed in CVS: http://bugs.php.net/fix.php?id=16258&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=16258&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=16258&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=16258&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=16258&r=support Expected behavior: http://bugs.php.net/fix.php?id=16258&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=16258&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=16258&r=submittedtwice