CVE-2007-5899: Infoleak

Q: Which deployments are exposed to this issue?

PHP versions before 5.2.5 are affected when output_add_rewrite_var rewrites a local form whose ACTION attribute points to a non-local URL. Forms that do not combine local rewriting with an external ACTION URL are not described as affected.

Q: What could an attacker obtain by exploiting it?

An attacker controlling or monitoring the non-local ACTION URL could read requests sent to that URL. Those requests may contain sensitive information, including a rewritten local session ID.

Q: What is the available remediation?

Upgrade PHP to version 5.2.5 or later. The issue is documented as affecting versions before 5.2.5.

Published Nov 20, 2007

Updated

The outputaddrewritevar function in PHP before 5.2.5 rewrites local forms in which the ACTION attribute references a non-local URL, which allows remote attackers to obtain potentially sensitive information by reading the requests for this URL, as demonstrated by a rewritten form containing a local session ID.

Affected Software

1 affected component

PHP PHP<=5.2.4

Event History

Nov 20, 2007

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

Which deployments are exposed to this issue?

PHP versions before 5.2.5 are affected when output_add_rewrite_var rewrites a local form whose ACTION attribute points to a non-local URL. Forms that do not combine local rewriting with an external ACTION URL are not described as affected.

What could an attacker obtain by exploiting it?

An attacker controlling or monitoring the non-local ACTION URL could read requests sent to that URL. Those requests may contain sensitive information, including a rewritten local session ID.

What is the available remediation?

Upgrade PHP to version 5.2.5 or later. The issue is documented as affecting versions before 5.2.5.

CVE-2007-5899: Infoleak

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What could an attacker obtain by exploiting it?

What is the available remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What could an attacker obtain by exploiting it?

What is the available remediation?