full-disclosure - Re: Advisory 18/2005: PHP Cross Site Scripting (XSS) Vulnerability in phpinfo()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <43665F43.5050303@php.net>
Date: Tue Nov  1 09:14:25 2005
From: sesser at php.net (Stefan Esser)
Subject: Re: Advisory 18/2005: PHP Cross Site Scripting
 (XSS)	Vulnerability in phpinfo()

Hello Matthew,

> That's a hell of a turnaround for you, Esser.  It's the first security
> bug I've reported in your software that's actually been fixed.  And it
> only took you *THREE YEARS*.  We're finally making some progress here.

Mr. Murphy, I don't know what your problem is, but the bug you refer to
and that is described in the bug tracker post is not the bug the
advisory contains. Just because you reported some XSS vulnerability in
phpinfo() does not mean that you can claim credit for every phpinfo()
XSS vulnerability that exists. So please simply shut up and go cry
elsewhere.

> Next time, you could try giving me credit for my research as well. 
> Thanks.

Yeah well... If you report the bug first you can get credit.

Stefan Esser

-- 
--------------------------------------------------------------------------
 Stefan Esser                                               sesser@....net
 Hardened-PHP Project                         http://www.hardened-php.net/

 GPG-Key                gpg --keyserver pgp.mit.edu --recv-key 0x15ABDA78
 Key fingerprint       7806 58C8 CFA8 CE4A 1C2C  57DD 4AE1 795E 15AB DA78
--------------------------------------------------------------------------