PT-2005-5396 · Pear · Pear Html Quickform Controller

Jeroen · Published 2005-12-31 · Updated 2008-09-05 · CVE-2005-4731

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PEAR HTML QuickForm Controller version 1.0.4

Description The issue allows remote attackers to obtain the session ID via an HTTP Referer field and possibly other vectors, because the Next action includes the SID in the URL even when session.use only cookies is configured.

Recommendations For PEAR HTML QuickForm Controller version 1.0.4, consider disabling the use of the SID in URLs as a temporary workaround until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-4731

Affected Products

Pear Html Quickform Controller

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2005-4731 · Security Note
• http://osvdb.org/23766 · Note
• http://pear.php.net/bugs/bug.php?id=3443 · Note
• http://pear.php.net/package/HTML_QuickForm_Controller/download · Note