Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 111015 - dev-lang/php // dev-php/php <= 4.4.0, <= 5.0.5 Cross Site Scripting (XSS) Vulnerability in phpinfo()
Summary: dev-lang/php // dev-php/php <= 4.4.0, <= 5.0.5 Cross Site Scripting (XSS) Vul...
Status: RESOLVED DUPLICATE of bug 111032
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All All
: High minor (vote)
Assignee: Gentoo Security
Depends on:
Reported: 2005-10-31 06:26 UTC by Vic Fryzel (shellsage) (RETIRED)
Modified: 2005-10-31 13:33 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Vic Fryzel (shellsage) (RETIRED) gentoo-dev 2005-10-31 06:26:34 UTC
The phpinfo() function outputs a large amount of information about the current
state of PHP. This includes information about PHP compilation options and
extensions, the PHP version, server information and environment (if compiled as
a module), the PHP environment, OS version information, paths, master and local
values of configuration options and request variables, HTTP headers, and the PHP

Because phpinfo() leaks a lot of information to the viewer it is not recommended
to leave a script executing phpinfo() on a  production server. However in
reality phpinfo() scripts are left open on a lot of servers. While this is
already bad enough, there is also a problem when request variables of a certain
form are displayed. With a properly crafted URL, that contains a stacked array
assignment it is f.e. possible to inject HTML code into the output of phpinfo(),
which could result in the leakage of domain cookies (f.e. session identifiers).

Reproducible: Always
Steps to Reproduce:
Comment 1 Thierry Carrez (RETIRED) gentoo-dev 2005-10-31 13:33:58 UTC
Regrouping issues...

*** This bug has been marked as a duplicate of 111032 ***