CVE-2005-3388PHP Vulnerability
Cross-site scripting (XSS) vulnerability in the phpinfo function in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL with a "stacked array assignment."
Published Oct 31, 2005 · Updated Aug 7, 2024
Key Facts
Routine patching- CVE-2005-3388 is a medium-severity vulnerability (CVSS 4.3 v2) affecting PHP, php7-bcmath (suse), php7-bz2 (suse) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 49% probability of exploitation in the next 30 days.
- Fixed versions are available, including PHP 0:4.3.9-3.9, php7 7.4.24-1.1, php7-bcmath 7.4.24-1.1.
- Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Scores
CVSS v2
4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS (30-day exploit likelihood)
49%
Higher than 98.8% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
40/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
- advisoryRHSA-2005:831
- advisoryRHSA-2005:838
- advisoryRHSA-2005:882
- advisoryRHSA-2006:0549
- advisoryhttp://www.hardened-php.net/advisory_182005.77.html
- patch17371
Description
Cross-site scripting (XSS) vulnerability in the phpinfo function in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL with a "stacked array assignment."
Affected Products
145 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| PHPPHP | 4.0.0, 4.0.1, 4.0.1-patch1, 4.0.1-patch2, 4.0.2, 4.0.3, 4.0.3-patch1, 4.0.4 | 0:4.3.9-3.9 |
| php7-bcmathsuse | See advisory | 7.4.24-1.1 |
| php7-bz2suse | See advisory | 7.4.24-1.1 |
| php7-calendarsuse | See advisory | 7.4.24-1.1 |
| php7-clisuse | See advisory | 7.4.24-1.1 |
Patched Releases
PHP
0:4.3.9-3.9
php7
7.4.24-1.1
php7-bcmath
7.4.24-1.1
php7-bz2
7.4.24-1.1
php7-calendar
7.4.24-1.1
php7-cli
7.4.24-1.1
php7-ctype
7.4.24-1.1
php7-curl
7.4.24-1.1
php7-dba
7.4.24-1.1
php7-devel
7.4.24-1.1
php7-dom
7.4.24-1.1
php7-enchant
7.4.24-1.1
php7-exif
7.4.24-1.1
php7-fileinfo
7.4.24-1.1
php7-ftp
7.4.24-1.1
php7-gd
7.4.24-1.1
php7-gettext
7.4.24-1.1
php7-gmp
7.4.24-1.1
php7-iconv
7.4.24-1.1
php7-intl
7.4.24-1.1
php7-json
7.4.24-1.1
php7-ldap
7.4.24-1.1
php7-mbstring
7.4.24-1.1
php7-mysql
7.4.24-1.1
php7-odbc
7.4.24-1.1
Timeline
Publicly disclosed
Oct 31, 2005
Last updated
Aug 7, 2024
References
- advisoryRHSA-2005:831
- advisoryRHSA-2005:838
- advisoryRHSA-2005:882
- advisoryRHSA-2006:0549
- advisoryhardened-php.net · advisory_182005.77.html
FAQ
Common Questions.
Cross-site scripting (XSS) vulnerability in the phpinfo function in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL with a "stacked array assignment."
Affected: PHP versions 4.0.0, 4.0.1, 4.0.1-patch1, 4.0.1-patch2, 4.0.2, 4.0.3, 4.0.3-patch1, 4.0.4; php7-bcmath (suse); php7-bz2 (suse), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including PHP 0:4.3.9-3.9, php7 7.4.24-1.1, php7-bcmath 7.4.24-1.1.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Is CVE-2005-3388 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo