|
|
Info |
Last Modified |
| about 1 year ago |
|
|
|
|
|
Description |
PHP contains a flaw that may allow a malicious user to inject PHP code into the 'PHPSESSID' session identifier. The flaw is due to lack of validation of the characters used in the 'PHPSESSID' session identifier. It is possible that the flaw may allow execution of arbitrary code resulting in a loss of integrity.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Exploit:
Exploit Unknown
OSVDB:
Concern
|
|
Solution |
Upgrade to version 4.4.3 or 5.1.4 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
|
|
Products |
|
PHP
 |
5.0.1 |
5.0.2 |
4.0.x |
4.1.x |
4.2.x |
4.4.0 |
5.0.5 |
5.1.2 |
4.4.2 |
4.4.1 |
4.3.x |
5.1.1 |
5.1.0 |
5.1.3 |
5.0.4 |
5.0.3 |
|
|
|
|
Credit |
- Stefan Esser - sesser
 hardened-php.net - www.hardened-php.net
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
