CVE-2007-5899: Infoleak
The outputaddrewritevar function in PHP before 5.2.5 rewrites local forms in which the ACTION attribute references a non-local URL, which allows remote attackers to obtain potentially sensitive information by reading the requests for this URL, as demonstrated by a rewritten form containing a local session ID.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
PHP versions before 5.2.5 are affected when output_add_rewrite_var rewrites a local form whose ACTION attribute points to a non-local URL. Forms that do not combine local rewriting with an external ACTION URL are not described as affected.
What could an attacker obtain by exploiting it?
An attacker controlling or monitoring the non-local ACTION URL could read requests sent to that URL. Those requests may contain sensitive information, including a rewritten local session ID.
What is the available remediation?
Upgrade PHP to version 5.2.5 or later. The issue is documented as affecting versions before 5.2.5.