Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
PHP Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) Vulnerability - CVE-2024-11234 - Vulnerability Database
PHP

PHP Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) Vulnerability - CVE-2024-11234

High
Reference: CVE-2024-11234
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2024-11234
Title: PHP Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) Vulnerability
Overview:

In PHP versions 8.1. before 8.1.31 8.2. before 8.2.26 8.3. before 8.3.14 when using streams with configured proxy and quotrequest_fulluriquot option the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server thus potentially gaining access to resources not normally available to the external user.