PT-2009-6312 · Php+2 · Php+2

Moriyoshi

·

Published

2009-12-21

·

Updated

2018-10-30

·

CVE-2009-4142

CVSS v2.0

4.3

Medium

VectorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.2.12
Description The issue concerns the htmlspecialchars function, which does not properly handle certain sequences, including overlong UTF-8 sequences, invalid Shift JIS sequences, and invalid EUC-JP sequences. This allows remote attackers to conduct cross-site scripting (XSS) attacks by placing a crafted byte sequence before a special character.
Recommendations For PHP versions prior to 5.2.12, update to version 5.2.12 or later to resolve the issue. As a temporary workaround, consider validating and sanitizing user input to minimize the risk of XSS attacks. Restrict the use of special characters in user input until the issue is resolved.

Exploit

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-4142
DSA-2001-1
HPSBUX02543
RHSA-2010:0040
RHSA-2010_0040

Affected Products

Hp-Ux
Php
Red Hat