CVE-2005-4731 | BDVDB-2026-15697 Detail

Description#

The Next action in PEAR HTML_QuickForm_Controller 1.0.4 includes the SID in the URL even when session.use_only_cookies is configured, which allows remote attackers to obtain the SID via an HTTP Referer field and possibly other vectors.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://pear.php.net/package/HTML_QuickForm_Controller/download
http://www.osvdb.org/23766
http://pear.php.net/bugs/bug.php?id=3443

Exploit#

No public exploit known

History#

Version 12006-03-15Record published in the CVE List.
Version 22024-08-07Most recent update recorded in the CVE List.