CVE-2005-3348 Other in n/a
Remote attackers can spoof web content and poison caches via CRLF injection in the charset parameter of phpSysInfo.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2005-3348?
CVE-2005-3348 is a medium-severity vulnerability in n/a, published on 18 Nov 2005. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HTTP response splitting vulnerability in index.php in phpSysInfo 2.4 and earlier, as used in phpgroupware 0.9.16 and earlier, and egroupware before 1.0.0.009, allows remote attackers to spoof web content and poison web caches via CRLF sequences in the charset parameter.
Weakness: CWE-352
Which versions are affected by CVE-2005-3348?
It affects 1 product.
Products include Phpsysinfo Phpsysinfo.
How do I fix CVE-2005-3348?
Upgrade to a fixed version.
Is CVE-2005-3348 being exploited?
There is no known exploitation of CVE-2005-3348 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2023-49006 Phpsysinfo Cross Site Request Forgery (CSRF) vulnerability
- CVE-2006-3360 phpSysInfo allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence
- CVE-2005-0869 Information disclosure in n/a
- CVE-2007-4048 Cross-site scripting in n/a
- CVE-2005-0870 Cross-site scripting in n/a
Sources
Also known as DEBIAN-CVE-2005-3348, GHSA-m952-67ch-qff2.