CVE-2005-3388: PHP phpinfo() cross-site scripting via crafted URL

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

medium priorityThe flaw is a reflected XSS with only partial integrity impact and no confirmed in-the-wild exploitation, but the affected PHP versions are long obsolete and phpinfo exposure is common.

What it is

PHP 4.x up to 4.4.0 and 5.x up to 5.0.5 contain a cross-site scripting flaw in the phpinfo function, reachable through a crafted URL using a stacked array assignment. An attacker can inject arbitrary script or HTML into the phpinfo output page, which matters because phpinfo pages are commonly exposed during debugging and misconfiguration.

Impact

An attacker can execute script in the browser context of a victim viewing the phpinfo page, enabling session theft, credential capture or page defacement. The CVSS 2.0 vector shows partial integrity impact only, with no confidentiality or availability impact.

Attack surface

Reached remotely over the network via a crafted URL; the CVSS vector indicates no authentication (Au:N) and medium attack complexity (AC:M). The description does not state whether user interaction is required, though reflected XSS typically requires the victim to follow a link.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is high (0.489 probability, 98.8th percentile), but reference tags only include Patch and Vendor Advisory, with no public exploit tag.

What to do

• Upgrade PHP to a fixed release (4.4.1 or later for the 4.x line, and the corresponding fixed 5.x release) as indicated by the vendor patch reference.
• Apply distribution vendor updates (Red Hat, Fedora Legacy, Gentoo, Mandriva, Novell, OpenPKG) where the packaged PHP cannot be upgraded directly.
• Remove or restrict access to any phpinfo() pages exposed on production systems.
• Deploy output encoding or a web application firewall rule to neutralize script injection in phpinfo responses until patching completes.

Detection

• Search web server access logs for requests to phpinfo pages containing array-style or bracketed query parameters.
• Inspect HTTP responses from phpinfo endpoints for reflected script or HTML from request parameters.
• Alert on scanner or exploit traffic patterns targeting phpinfo URLs across the environment.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.