PT-2012-13: Cross-Site Scripting in PHP

Vulnerable software

PHP
Version: 5.4.6 and earlier

Application link:
http://php.net/

Severity level

Severity level: Low
Impact: Cross-Site Scripting
Access Vector: Local

CVSS v2:
Base Score: 1.7
Vector: (AV:L/AC:L/Au:S/C:P/I:N/A:N)

CVE: not assigned

Software description

PHP (Hypertext Preprocessor) is a general-purpose script programming language that is widely used to develop web applications.

Vulnerability description

Positive Research Center detected Cross-Site Scripting in PHP application.

An attacker can conduct cross-site scripting attack because of incorrect implementation of php_info_print_stream_hash function in phpinfo in PHP.

Vulnerability exists in /ext/sqlite3/ info.c file. Here is the vulnerable code:

static void php_info_print_stream_hash(const char *name, HashTable *ht TSRMLS_DC) /* {{{ */ {
...
while (zend_hash_get_current_key_ex(ht, &key, &len, NULL, 0, &pos) == HASH_KEY_IS_STRING)
{
php_info_print(key);
...

Exploitation example
This PHP code can cause cross-site scripting.
<?php
stream_filter_register("<script>alert('Positive')</script>","a");
phpinfo();
?>

How to fix

Update your software up to the latest version.

Advisory status

22.06.2012 - Vendor is notified
22.06.2012 - Vendor gets vulnerability details
14.09.2012 - Vendor releases fixed version and details
04.02.2013 - Public disclosure

Credits

The vulnerability has discovered by Sergey Bobrov, Positive Research Center (Positive Technologies Company)

References

http://en.securitylab.ru/lab/PT-2012-13
https://bugs.php.net/patch-display.php?bug_id=62964&patch=use_php_info_print_html_esc&revision=latest

Reports on the vulnerabilities previously discovered by Positive Research:

http://ptsecurity.com/research/advisory/
http://en.securitylab.ru/lab/

Threatscape