medium5.0Public exploit code
CVE-2008-5185
The highlighting functionality in geshi.php in GeSHi before 1.0.8 allows remote attackers to cause a denial of service (infinite loop) via an XML sequence cont…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- GeSHi 1.0.x - XML Parsing Remote Denial of Service2008-11-20 · dos · multiple · Verified
Impact
The highlighting functionality in geshi.php in GeSHi before 1.0.8 allows remote attackers to cause a denial of service (infinite loop) via an XML sequence containing an opening delimiter without a closing delimiter, as demonstrated using "<".
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Geshi | Geshi | through 1.0.7.22 Versions 1.0.0, 1.0.1, 1.0.2, 1.0.2_beta_1, 1.0.3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://geshi.svn.sourceforge.net/viewvc/geshi/trunk/geshi-1.0.X/src/geshi.php?r1=1321&r2=1322&view=patch
- http://www.openwall.com/lists/oss-security/2008/11/20/4
- http://www.securityfocus.com/bid/32377
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46769
- http://geshi.svn.sourceforge.net/viewvc/geshi/trunk/geshi-1.0.X/src/geshi.php?r1=1321&r2=1322&view=patch
- http://www.openwall.com/lists/oss-security/2008/11/20/4
- http://www.securityfocus.com/bid/32377
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46769