Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 17 Apr 2014 01:25:03 -0400
From: Adam Caudill <>
To: "" <>
Subject: CVE Request - XXS in phpMyID (openid_error)

There is a XXS vulnerability in phpMyID v0.9, in the openid_error parameter. The value passed into openid_error is passed through to the output without modification when openid.mode is “error”.


Here is the code at fault:

MyID.php Line 569:
  function error_mode () {
  		? wrap_html($_REQUEST['openid_error'])
  		: error_500();

MyID.php Line 1559:
  function wrap_html ( $message ) {
  	global $charset, $profile;

  	header('Content-Type: text/html; charset=' . $charset);
  	echo '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "">
  <link rel="openid.server" href="' . $profile['req_url'] . '" />
  <link rel="openid.delegate" href="' . $profile['idp_url'] . '" />
  ' . implode("\n", $profile['opt_headers']) . '
  <meta name="charset" content="' . $charset . '" />
  <meta name="robots" content="noindex,nofollow" />
  <p>' . $message . '</p>


Project Page:

The author has stated that the project is no longer maintained, so hasn’t been notified, and thus there is no fixed version. This is being submitted to raise awareness among those that use this application, and in hopes that a new maintainer will take the project over and address the outstanding issues.

Adam Caudill

Download attachment "signature.asc" of type "application/pgp-signature" (802 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.