News
|
vendredi 04 juillet | Vulnerability with PHPSESSSID (version < 4.3.2)
Source: php.net ¬ 3774 affichages
PHP may automatically embed session IDs as part of URLs in a web page.
The automatic embedding is called "transparent SID support".
It is possible to dictate the value of the session ID using the
PHPSESSID URL parameter. PHP does little to validate the dictated ID.
Combined with lack of URL encoding and HTML encoding of automatically
embedded session IDs, this makes PHP open to Cross-site Scripting
attacks.
Original Security Bulletin
Sverre H. Huseby ± Sécurité PHP
|
Add a comment
|
Your comments
|
|
» No comment.
|
|
|
