CVE-2007-5899

The output_add_rewrite_var function in PHP before 5.2.5 rewrites local forms in which the ACTION attribute references a non-local URL, which allows remote…

published November 20, 2007

CVSS
—
EPSS
3%
Percentile
88.8
In the wild
Unconfirmed
What it is

The output_add_rewrite_var function in PHP before 5.2.5 rewrites local forms in which the ACTION attribute references a non-local URL, which allows remote attackers to obtain potentially sensitive information by reading the requests for this URL, as demonstrated by a rewritten form containing a local session ID.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03393 · 88.8th percentile
Published
2007-11-20T19:00Z
EPSS history
Timeline
  • 20 NOV 19:00Z
    The output_add_rewrite_var function in PHP before 5.2.5 rewrites local forms in which the ACTION attribute references a non-local URL, which allows remote…
    cvelistv5