CVE-2005-4731

Name of the Vulnerable Software and Affected Versions PEAR HTML QuickForm Controller version 1.0.4

Description The issue allows remote attackers to obtain the session ID via an HTTP Referer field and possibly other vectors, because the Next action includes the SID in the URL even when session.use only cookies is configured.

Recommendations For PEAR HTML QuickForm Controller version 1.0.4, consider disabling the use of the SID in URLs as a temporary workaround until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.