9 lines
No EOL
453 B
Text
9 lines
No EOL
453 B
Text
source: https://www.securityfocus.com/bid/24268/info
|
|
|
|
PHP is prone to an HTTP-response-header-injection vulnerability because it fails to sanitize user-supplied input.
|
|
|
|
An attacker can exploit this issue to inject additional cookie attributes into session cookies. This may lead to other attacks.
|
|
|
|
This issue affects PHP 5.2.3 (and prior versions) and PHP 4.4.7 (and prior versions).
|
|
|
|
http://www.example.com/session.php/PHPSESSID=ID;INJECTED=ATTRIBUTE;/ |