Jasper Bryant-Greene wrote:

> T=F5nu Samuel wrote:
>
>>
>> Nice! I was really nervous already as I got bombed with e-mails and I=20
>> really did not knew much more than was discovered. Meanwhile I am=20
>> bit disappointed that we had nearly month such a bug in wild and=20
>> software distributors like SuSE in my case did not published patches.=20
>> I think as long enough time passed and I hope distributors maybe need=20
>> to see it - I publish exploit. Sorry, this was discovered=20
>> independently and for me it looks like very serious problem.
>>
>> Script is:
>> <?php
>>
>> $foobar=3Dhtml_entity_decode($_GET['foo']);
>> echo $foobar;
>>
>> ?>
>
>
> I very much doubt there are many applications at all containing code=20
> like this. It is illogical to be decoding html entities from user=20
> input. Therefore I would not call this a "very serious problem" and=20
> certainly not a critical bug.

Not really. While this is not part of the HTML / HTTP standards, major=20
browsers
around try to send such characters in the user input as HTML entities=20
that cannot
all be represented in the encoding of the originating HTML page, it's=20
quite probable
the function is used to filter the query strings.

Moriyoshi

>
> Jasper
>