Vulnerabilities > CVE-2005-4731 - Remote Security vulnerability in the PHP Group Pear Html Quickform Controller 1.0.4
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
NONE Availability impact
NONE Summary
The Next action in PEAR HTML_QuickForm_Controller 1.0.4 includes the SID in the URL even when session.use_only_cookies is configured, which allows remote attackers to obtain the SID via an HTTP Referer field and possibly other vectors. Upgrade to version 1.0.5 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |