Session Identifier Exposure in PEAR HTML_QuickForm_Controller by PEAR
CVE-2005-4731
Currently unrated
What is CVE-2005-4731?
The PEAR HTML_QuickForm_Controller version 1.0.4 has a vulnerability where the Session Identifier (SID) is exposed within the URL, even when the session.use_only_cookies setting is active. This flaw permits remote attackers to capture the SID through the HTTP Referer header, which can lead to unauthorized access and session hijacking. It is crucial for administrators using this component to take immediate action to mitigate the risks associated with this exposure.