HIGH7.5

GHSA-4wgf-9x5r-p938

Weak Cryptography in PHP-Proxy

Details

The [str_rot_pass](https://github.com/Athlon1600/php-proxy/blob/9cc42804ddafa079b86b947e4dd83852edddffca/src/helpers.php#L66) function in vendor/atholn1600/php-proxy/src/helpers.php in PHP-Proxy 5.1.0 uses weak cryptography, which makes it easier for attackers to calculate the authorization data needed for local file inclusion.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/athlon1600/php-proxy

Introduced in: 0

No fixed version published yet for athlon1600/php-proxy (composer). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2018-19784[ADVISORY]
https://github.com/Athlon1600/php-proxy-app/issues/139[WEB]
https://github.com/0xUhaw/CVE-Bins/tree/master/PHP-Proxy[WEB]
https://github.com/Athlon1600/php-proxy[PACKAGE]