← Database

CVE-2005-4731

MEDIUM CVSS: 5.0 Published: 2005-12-31 Modified: 2026-06-16

Description

The Next action in PEAR HTML_QuickForm_Controller 1.0.4 includes the SID in the URL even when session.use_only_cookies is configured, which allows remote attackers to obtain the SID via an HTTP Referer field and possibly other vectors.

Affected Platforms

The Php Group Pear Html Quickform Controller

Weakness Type

NVD-CWE-Other

References