CVE-2005-0870

NameCVE-2005-0870
DescriptionMultiple cross-site scripting (XSS) vulnerabilities in phpSysInfo 2.3, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) sensor_program parameter to index.php, (2) text[language], (3) text[template], or (4) hide_picklist parameter to system_footer.php.
SourceCVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
ReferencesDSA-724-1, DSA-897-1, DSA-898-1, DSA-899-1
NVD severitymedium (attack range: remote)
Debian/oldstablenot vulnerable.
Debian/stablenot vulnerable.
Debian/testingnot vulnerable.
Debian/unstablenot vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
phpsysinfo (PTS)squeeze3.0~rc6-1.1fixed
jessie, sid, wheezy3.0.17-1fixed

The information above is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
egroupwaresource(unstable)1.0.0.009.dfsg-3-3medium
egroupwaresourcesarge1.0.0.007-2.dfsg-2sarge4mediumDSA-899-1
phpgroupwaresource(unstable)0.9.16.008-2medium
phpgroupwaresourcesarge0.9.16.005-3.sarge4mediumDSA-898-1
phpgroupwaresourcewoody0.9.14-0.RC3.2.woody5mediumDSA-898-1
phpsysinfosource(unstable)2.3-7medium
phpsysinfosourcesarge2.3-4sarge1mediumDSA-897-1
phpsysinfosourcewoody2.0-3woody3mediumDSA-897-1

Notes

Fix in phpsysinfo 2.3-3 was apparently incomplete.

Search for package or bug name: Reporting problems