PHP < 4.3.8 Multiple Vulnerabilities

medium Nessus Plugin ID 13650


The remote web server uses a version of PHP that is affected by multiple vulnerabilities.


According to its banner, the version of PHP 4.3.x installed on the remote host is prior to 4.3.7. It is, therefore, potentially affected by a bug that could allow an attacker to execute arbitrary code on the remote host if the option memory_limit is set. Another bug in the function strip_tags() may allow an attacker to bypass content restrictions when submitting data and may lead to cross-site scripting issues.


Upgrade to PHP 4.3.8.

See Also

Plugin Details

Severity: Medium

ID: 13650

File Name: php_strip_tags_memory_limit_vuln.nasl

Version: 1.26

Type: remote

Family: CGI abuses

Published: 7/15/2004

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information


Risk Factor: High

Score: 8.5


Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:php:php

Required KB Items: www/PHP

Exploit Ease: No exploit is required

Patch Publication Date: 7/13/2004

Vulnerability Publication Date: 7/14/2004

Exploitable With


Reference Information

CVE: CVE-2004-0594, CVE-2004-0595

BID: 10724, 10725

CWE: 20, 442, 629, 711, 712, 722, 725, 74, 750, 751, 79, 800, 801, 809, 811, 864, 900, 928, 931, 990