|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2012-08-29 12:06 UTC] ymaryshev at ptsecurity dot ru
Description:
------------
An attacker can conduct cross-site scripting attack because of incorrect
implementation of php_info_print_stream_hash function in phpinfo in PHP.
Vulnerability exists in /ext/sqlite3/ info.c file. Here is the vulnerable code:
static void php_info_print_stream_hash(const char *name, HashTable *ht TSRMLS_DC)
/* {{{ */ {
...
while (zend_hash_get_current_key_ex(ht, &key, &len, NULL,
0, &pos) == HASH_KEY_IS_STRING)
{
php_info_print(key);
...
Test script:
---------------
<?php
stream_filter_register("<script>alert('Positive')</script>","a");
phpinfo();
?>
Patchesuse_php_info_print_html_esc (last revision 2012-09-14 05:56 UTC by david at nnucomputerwhiz dot com)Pull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Sun Oct 26 20:00:01 2025 UTC |
Unfortunately most of PHP output functions are vulnerable in the same way... For example, built-in echo function: $a = "<script>alert('Positive')</script>"; echo $a; // echo IS VULNERABLE!!!11oneoneeleven Seriously, healthy programmer never allows untrusted data (user input) to be passed to stream_filter_register() as well as to other functions. Moreover, phpinfo() should never be exposed.