CVE-2005-3388

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 48.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-11-01 · updated 2026-06-16

Description

Cross-site scripting (XSS) vulnerability in the phpinfo function in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL with a "stacked array assignment."

Affected products

PHP: 4.0.0, 4.0.1, 4.0.1-patch1, 4.0.1-patch2, 4.0.2, 4.0.3 (+42)

References

http://itrc.hp.com/service/cki/docDisplay.do?docId=c00786522
http://rhn.redhat.com/errata/RHSA-2006-0549.html
http://secunia.com/advisories/17371
http://secunia.com/advisories/17490
http://secunia.com/advisories/17510
http://secunia.com/advisories/17531
http://secunia.com/advisories/17557
http://secunia.com/advisories/17559
http://secunia.com/advisories/18198
http://secunia.com/advisories/18669
http://secunia.com/advisories/21252
http://secunia.com/advisories/22691

Get alerted when CVE-2005-3388 or the next vulnerability affects your stack