CVE-2005-4731 The Next action in PEAR HTML_QuickForm_Controller 1.0.4 includes the SID in the URL even when session.use_only_cookies is configured, which allows remote attackers to obtain the SID via an HTTP Refere...
MediumCVSS 5.0
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Next action in PEAR HTML_QuickForm_Controller 1.0.4 includes the SID in the URL even when session.use_only_cookies is configured, which allows remote attackers to obtain the SID via an HTTP Referer field and possibly other vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| php pear html quickform controller | = 1.0.4 | No fix listed |
References
- pear.php.net
- pear.php.net
- 23766 vdb-entry