PHP PHPInfo Cross-Site Scripting Vulnerability

Bugtraq ID:	7805
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 12 2002 12:00AM
Updated:	Oct 12 2002 12:00AM
Credit:	Matthew Murphy is credited with the initial discovery of this vulnerability.
Vulnerable:	PHP PHP 4.4 .0 PHP PHP 4.3.11 PHP PHP 4.3.10 + Gentoo Linux + Redhat Fedora Core3 + Trustix Secure Enterprise Linux 2.0 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 + Trustix Secure Linux 1.5 PHP PHP 4.3.9 PHP PHP 4.3.8 + Mandriva Linux Mandrake 10.1 x86_64 + Mandriva Linux Mandrake 10.1 + S.u.S.E. Linux Personal 9.2 + Turbolinux Turbolinux Server 10.0 + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia32 PHP PHP 4.3.7 PHP PHP 4.3.6 PHP PHP 4.3.5 PHP PHP 4.3.4 + MandrakeSoft Corporate Server 3.0 x86_64 + MandrakeSoft Corporate Server 3.0 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 + S.u.S.E. Linux Personal 9.1 PHP PHP 4.3.3 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 + Turbolinux Home + Turbolinux Turbolinux 10 F... + Turbolinux Turbolinux Desktop 10.0 PHP PHP 4.3.2 PHP PHP 4.3.1 + Mandriva Linux Mandrake 9.1 ppc + Mandriva Linux Mandrake 9.1 + OpenPKG OpenPKG Current + S.u.S.E. Linux Personal 8.2 PHP PHP 4.3 PHP PHP 4.2.3 + EnGarde Secure Linux 1.0.1 + MandrakeSoft Corporate Server 2.1 x86_64 + MandrakeSoft Corporate Server 2.1 + Mandriva Linux Mandrake 9.0 + Turbolinux Turbolinux Server 8.0 + Turbolinux Turbolinux Server 7.0 + Turbolinux Turbolinux Workstation 8.0 + Turbolinux Turbolinux Workstation 7.0 PHP PHP 4.2.2 + Gentoo Linux 1.4 _rc1 + Gentoo Linux 1.2 + OpenPKG OpenPKG 1.1 + Redhat Linux 8.0 i386 + Redhat Linux 8.0 + SuSE Linux 8.1 PHP PHP 4.2.1 - FreeBSD FreeBSD 4.6 - FreeBSD FreeBSD 4.5 - FreeBSD FreeBSD 4.4 - FreeBSD FreeBSD 4.3 + Slackware Linux 8.1 PHP PHP 4.2 .0 PHP PHP 4.2 -dev PHP PHP 4.1.2 + Apple Mac OS X 10.1.5 + Apple Mac OS X 10.1.4 + Apple Mac OS X 10.1.3 + Apple Mac OS X 10.1.2 + Apple Mac OS X 10.1.1 + Apple Mac OS X 10.1 + Apple Mac OS X 10.1 + Apple Mac OS X 10.0.4 + Apple Mac OS X 10.0.3 + Apple Mac OS X 10.0.2 + Apple Mac OS X 10.0.1 + Apple Mac OS X 10.0 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + MandrakeSoft Multi Network Firewall 2.0 + MandrakeSoft Single Network Firewall 7.2 + Mandriva Linux Mandrake 8.2 ppc + Mandriva Linux Mandrake 8.2 PHP PHP 4.1.1 PHP PHP 4.1 .0 + SuSE Linux 8.0 i386 + SuSE Linux 8.0 PHP PHP 4.0.7 RC3 PHP PHP 4.0.7 RC2 PHP PHP 4.0.7 RC1 PHP PHP 4.0.7 PHP PHP 4.0.6 + Caldera OpenLinux Server 3.1.1 + Caldera OpenLinux Server 3.1 + Caldera OpenLinux Workstation 3.1.1 + Caldera OpenLinux Workstation 3.1 + HP Secure OS software for Linux 1.0 - IBM AIX 4.3.3 - IBM AIX 4.3.2 - IBM AIX 4.3.1 - IBM AIX 4.3 - IBM AIX 5.1 + MandrakeSoft Corporate Server 1.0.1 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 + Mandriva Linux Mandrake 7.2 + Mandriva Linux Mandrake 7.1 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 + Redhat Linux 7.2 + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 alpha + Redhat Linux 7.1 + Redhat Linux 7.0 i386 + Redhat Linux 7.0 alpha + Redhat Linux 7.0 + Sun Cobalt RaQ 550 + Sun LX50 + SuSE Linux 7.3 sparc + SuSE Linux 7.3 ppc + SuSE Linux 7.3 i386 + SuSE Linux 7.3 + SuSE Linux 7.2 i386 + SuSE Linux 7.2 + Trustix Secure Linux 1.5 PHP PHP 4.0.5 PHP PHP 4.0.4 + Compaq Compaq Secure Web Server PHP 1.0 + Guardian Digital Engarde Secure Linux 1.0.1 + SuSE Linux 7.2 + SuSE Linux 7.1 x86 + SuSE Linux 7.1 sparc + SuSE Linux 7.1 ppc + SuSE Linux 7.1 alpha + SuSE Linux 7.1 + SuSE Linux 7.0 sparc + SuSE Linux 7.0 ppc + SuSE Linux 7.0 i386 + SuSE Linux 7.0 alpha + SuSE Linux 7.0 PHP PHP 4.0.3 pl1 + SuSE Linux 6.4 ppc + SuSE Linux 6.4 i386 + SuSE Linux 6.4 alpha + SuSE Linux 6.4 PHP PHP 4.0.3 + Debian Linux 2.2 sparc + Debian Linux 2.2 powerpc + Debian Linux 2.2 IA-32 + Debian Linux 2.2 arm + Debian Linux 2.2 alpha + Debian Linux 2.2 68k + Debian Linux 2.2 + Sun Cobalt Control Station 4100CS + Sun Cobalt Qube3 Japanese 4000WGJ + Sun Cobalt Qube3 Japanese w/ Caching and RAID 4100WGJ + Sun Cobalt Qube3 Japanese w/Caching 4010WGJ + Sun Cobalt RaQ XTR 3500R + Sun Cobalt RaQ XTR Japanese 3500R-ja PHP PHP 4.0.2 PHP PHP 4.0.1 pl2 PHP PHP 4.0.1 pl1 PHP PHP 4.0.1 + Sun Cobalt Qube3 4000WG + Sun Cobalt Qube3 w/ Caching and RAID 4100WG + Sun Cobalt Qube3 w/Caching 4010WG + Sun Cobalt RaQ4 3001R + Sun Cobalt RaQ4 Japanese RAID 3100R-ja + Sun Cobalt RaQ4 RAID 3100R PHP PHP 4.0 0
Not Vulnerable:	PHP PHP 4.4.1

PHP PHPInfo Cross-Site Scripting Vulnerability

Scripts that include the PHP phpinfo() debugging function may be prone to cross-site scripting attacks. This could permit remote attackers to create a malicious link to a vulnerable PHP script that includes hostile client-side script code or HTML. If this link is visited, the attacker-supplied code may be rendered in the browser of the user who visit the malicious link.

PHP PHPInfo Cross-Site Scripting Vulnerability

The following example was submitted:

http://www.example.com/info.php?variable=[code]

where [code] equals hostile HTML or script code.

PHP PHPInfo Cross-Site Scripting Vulnerability

Solution:
The vendor has addressed this issue in PHP version 4.4.1:


PHP PHP 4.0 0

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.0.1

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.0.1 pl2

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.0.1 pl1

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.0.2

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.0.3 pl1

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.0.3

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.0.4

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.0.5

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.0.6

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.0.7 RC1

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.0.7 RC3

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.0.7

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.0.7 RC2

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.1 .0

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.1.1

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.1.2

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.2 -dev

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.2 .0

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.2.1

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.2.2

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.2.3

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.3

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.3.1

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.3.10

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.3.11

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.3.2

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.3.3

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.3.4

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.3.5

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.3.6

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.3.7

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.3.8

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.3.9

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHP 4.4 .0

• PHP php-4.4.1.tar.gz
  http://www.php.net/get/php-4.4.1.tar.gz

PHP PHPInfo Cross-Site Scripting Vulnerability

References:

• Bug #19881 - phpinfo() Security Problem (PHP)
  
• PHP 4.4.1 released (PHP)
  
• PHP Homepage (PHP)
  
• PHP XSS exploit in phpinfo() (silent needle )