PT-2012-13: Cross-Site Scripting in PHP

Vulnerable software

Version: 5.4.6 and earlier

Application link:

Severity level

Severity level: Low
Impact: Cross-Site Scripting
Access Vector: Local

CVSS v2:
Base Score: 1.7
Vector: (AV:L/AC:L/Au:S/C:P/I:N/A:N)

CVE: not assigned

Software description

PHP (Hypertext Preprocessor) is a general-purpose script programming language that is widely used to develop web applications.

Vulnerability description

Positive Research Center detected Cross-Site Scripting in PHP application.

An attacker can conduct cross-site scripting attack because of incorrect implementation of php_info_print_stream_hash function in phpinfo in PHP.

Vulnerability exists in /ext/sqlite3/ info.c file. Here is the vulnerable code:

static void php_info_print_stream_hash(const char *name, HashTable *ht TSRMLS_DC) /* {{{ */ {
while (zend_hash_get_current_key_ex(ht, &key, &len, NULL, 0, &pos) == HASH_KEY_IS_STRING)

Exploitation example
This PHP code can cause cross-site scripting.

How to fix

Update your software up to the latest version.

Advisory status

22.06.2012 - Vendor is notified
22.06.2012 - Vendor gets vulnerability details
14.09.2012 - Vendor releases fixed version and details
04.02.2013 - Public disclosure


The vulnerability has discovered by Sergey Bobrov, Positive Research Center (Positive Technologies Company)


Reports on the vulnerabilities previously discovered by Positive Research: