PT-2003-1629 · Php · Php

Sverre H. Huseby · Published 2003-06-20 · Updated 2018-05-03 · CVE-2003-0442

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: PHP versions prior to 4.3.2

Description: The issue is related to a cross-site scripting (XSS) flaw in the transparent SID support capability. This flaw allows remote attackers to insert arbitrary script via the PHPSESSID parameter. The application fails to validate PHPSESSID variables, which could enable a user to create a specially crafted URL that executes arbitrary code in a user's browser, leading to a loss of integrity.

Recommendations: For PHP versions prior to 4.3.2, update to version 4.3.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the PHPSESSID parameter to minimize the risk of exploitation. Avoid using the PHPSESSID parameter in sensitive operations until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2003-0442

DSA-351

Affected Products

Php

References · 22

• 🔥 http://shh.thathost.com/secadv/2003-05-11-php.txt · Exploit
• 🔥 https://exploit-db.com/exploits/22696 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-0442 · Security Note
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000691 · Vendor Advisory
• http://debian.org/security/2003/dsa-351 · Vendor Advisory
• http://turbolinux.co.jp/security/2003/TLSA-2003-47j.txt · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2003:082 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-204.html · Vendor Advisory
• http://oval.mitre.org/oval/definitions/data/oval485.html · Note
• http://marc.theaimsgroup.com/?l=bugtraq&m=105449314612963&w=2 · Note
• http://mandrakesoft.com/security/advisories?name=MDKSA-2003:082 · Note
• http://securitytracker.com/id?1008653 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A485 · Note
• http://osvdb.org/4758 · Note
• http://ciac.org/ciac/bulletins/n-112.shtml · Note