OSVDB ID: 2111

Title: PHP Mail Function ASCII Control Character Header Spoofing

Info

Disclosure
Jul 30, 2003

Discovery
Aug 23, 2002

Dates

Exploit
Jul 30, 2003

Solution
Unknown

Description

 PHP 4.x to 4.2.2 contains a flaw that exist in the mail() function that does not properly sanitize user input. It is possible for a user may pass ASCII control characters to the mail() function that could alter the headers of email. This could result in spoofed mail headers.

Classification

Unknown or Incomplete

Solution

 Upgrade to the latest version of PHP available, or disable the mail() function in the php.ini.

Products

OpenPKG

OpenPKG

 1.0
1.1
1.2

PHP Group

PHP

 3.0
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.1.0
4.1.1
4.1.2
4.2.0
4.2.1
4.2.2

References

Credit

Unknown or Incomplete


Direct URL: http://osvdb.org/36218