CyberSec.Space Logo
Back to CVE Browser

CVE-2005-4731

MEDIUM
5.0
CVSS Severity Score
EPSS Score0.1670%
EPSS Percentile16.67th
PublishedDec 31, 2005
Last ModifiedApr 16, 2026

Vulnerability Description

The Next action in PEAR HTML_QuickForm_Controller 1.0.4 includes the SID in the URL even when session.use_only_cookies is configured, which allows remote attackers to obtain the SID via an HTTP Referer field and possibly other vectors.

Affected Platforms (CPE)

📦
The Php Group

Pear Html Quickform Controller

= 1.0.4

References & Advisories

🔗 http://pear.php.net/bugs/bug.php?id=3443
🔗 http://pear.php.net/package/HTML_QuickForm_Controller/download
🔗 http://www.osvdb.org/23766
🔗 http://pear.php.net/bugs/bug.php?id=3443
🔗 http://pear.php.net/package/HTML_QuickForm_Controller/download
🔗 http://www.osvdb.org/23766

Related Vulnerabilities

CVE-2005-266910.0

Computer Associates (CA) Message Queuing (CAM / CAFT) 1.05, 1.07 before Build 220_13, and 1.11 before Build 29_13 allows remote at...

CVE-2005-129910.0

The inserter.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.

CVE-2005-266810.0

Multiple buffer overflows in Computer Associates (CA) Message Queuing (CAM / CAFT) 1.05, 1.07 before Build 220_13, and 1.11 before...

CVE-2005-063510.0

Buffer overflow in Foxmail Server 2.0 allows remote attackers to execute arbitrary code via a long USER command.