5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-43717

CVE-2025-43717: PEAR HTTP_Request2 vulnerable to Cross-site Scripting

In PEAR HTTP_Request2 before 2.7.0, multiple files in the tests directory, notably tests/_network/getparameters.php and tests/_network/postparameters.php, reflect any GET or POST parameters, leading to XSS.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-43717

CVE-2025-43717:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pear/http_request2	composer	< 2.7.0	2.7.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in multiple PHP scripts within the 'tests/_network/' directory. These scripts were intended for testing HTTP request functionalities but were found to reflect various parts of incoming HTTP requests (GET parameters, POST parameters, authentication details, cookies, raw POST body, and uploaded file metadata) directly into the HTTP response without proper HTML escaping. This behavior makes them vulnerable to Cross-Site Scripting (XSS) if these test scripts are accessible via a web server and an attacker can craft requests with malicious input.

The commit 07925aa77e441dba0ff0fa973a09802729cb838f addresses these vulnerabilities by consistently applying htmlspecialchars() to all data before it is echoed or otherwise outputted in these test scripts. The affected code in each script is within its global execution scope. In PHP profiling or stack traces, code executed in the global scope of a script is often referred to as {main}(). Therefore, {main}() is used as the function name, with the respective file path indicating the specific vulnerable script. The vulnerability description explicitly mentions getparameters.php and postparameters.php but also refers to "multiple files," which is consistent with the broad set of changes in the patch.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.