vulnwire
4.3med

CVE-2003-04421 exploit

Cross-site scripting (XSS) vulnerability in the transparent SID support capability for PHP before 4.3.2 (session.use_trans_sid) allows remo…

Published 23 y ago · modified 4 mo ago · JSON

CVSS
4.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
7.0%
percentile 94%
Public exploits
1
Exploit-DB

Cross-site scripting (XSS) vulnerability in the transparent SID support capability for PHP before 4.3.2 (session.use_trans_sid) allows remote attackers to insert arbitrary script via the PHPSESSID parameter.

Exploit prediction (EPSS)

6.98% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

Exploits and detections

  • EDB-22696 PHP 4.x - Transparent Session ID Cross-Site Scripting · remote · 2003-05-30

CVSS scores

Assigned byVersionScoreVector
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Technology feeds
PHP (RSS, critical only)

References

  • mandriva.com /security/advisories?name=MDKSA-2003:082 · vendor-advisory, x_refsource_MANDRAKE, x_transferred
  • securitytracker.com /id?1008653 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • securityfocus.com /bid/7761 · vdb-entry, x_refsource_BID, x_transferred
  • distro.conectiva.com.br /atualizacoes/?id=a&anuncio=000691 · vendor-advisory, x_refsource_CONECTIVA, x_transferred
  • shh.thathost.com /secadv/2003-05-11-php.txt · x_refsource_MISC, x_transferred
  • debian.org /security/2003/dsa-351 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/12259 · vdb-entry, x_refsource_XF, x_transferred
  • marc.info /?l=bugtraq&m=105760591228031&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • turbolinux.co.jp /security/2003/TLSA-2003-47j.txt · vendor-advisory, x_refsource_TURBO, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A485 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • marc.info /?l=bugtraq&m=105449314612963&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • osvdb.org /4758 · vdb-entry, x_refsource_OSVDB, x_transferred
  • ciac.org /ciac/bulletins/n-112.shtml · third-party-advisory, government-resource, x_refsource_CIAC, x_transferred
  • redhat.com /support/errata/RHSA-2003-204.html · vendor-advisory, x_refsource_REDHAT, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.