Description
A regression error in the phpinfo function in PHP 4.4.3 to 4.4.6, and PHP 6.0 in CVS, allows remote attackers to conduct cross-site scripting (XSS) attacks via GET, POST, or COOKIE array values, which are not escaped in the phpinfo output, as originally fixed for CVE-2005-3388.
Remediation
References
Related Vulnerabilities
Oracle JRE CVE-2020-2590 Vulnerability (CVE-2020-2590)
PHP Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2011-3379)
Dotclear Permissions, Privileges, and Access Controls Vulnerability (CVE-2011-1584)
IBM WebSEAL Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-1805)
WordPress Plugin Facebook Page Photo Gallery Cross-Site Scripting (2.0.9)