Exploitation Summary
EIP tracks 1 public exploit for CVE-2004-0595. PoCs published by Stefan Esser.
AI-analyzed exploit summary This is a writeup describing a vulnerability in PHP's strip_tags() function that allows bypassing input sanitization, leading to XSS or HTML injection. The issue arises when malformed tags like <\0script> are used and magic_quotes_gpc is disabled.
Description
The strip_tags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null (\0) characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and facilitate the exploitation of cross-site scripting (XSS) vulnerabilities.
Exploits (1)
This is a writeup describing a vulnerability in PHP's strip_tags() function that allows bypassing input sanitization, leading to XSS or HTML injection. The issue arises when malformed tags like <\0script> are used and magic_quotes_gpc is disabled.