JVN#50327700 PHP vulnerable to cross-site scripting

PHP is an open source scripting language that is especially suited for Web development. PHP contains a cross-site scripting vulnerability as it does not properly handle errors.

Impact

An arbitrary script may be executed on the user’s web browser.

Solution

Update the Software
Apply the latest update provided by the developer.

According to the developer, PHP 4.X is no longer supported. Users of PHP 4.X are recommended to upgrade to PHP 5.2.X.

Products Affected

• PHP 5.2.7 and earlier
  If PHP is configured with display_errors=off in php.ini, it is not affected.
  Additionally, PHP 5.3.0alpha is not affected.