PHP mail function ASCII control character header spoofing vulnerability
PHP mail function ASCII control character header spoofing vulnerability
Published on 2004-03-27. Updated on 2007-03-20.
Description:
This alert was generated using only banner information. It may be a false positive.
The PHP mail function does not properly sanitize user input. Because of this, a user may pass ASCII control characters to the mail() function that could alter the headers of email. This could result in spoofed mail headers.
Affected PHP versions (up to 4.2.2).
Impact:
A malicious user may change email headers.
Recommendation:
Upgrade PHP to the latest version.
Alert Tags: configuration
ApplicableApplicationServer : PHP
ApplicableOS: All
ApplicableWebServer: All
References:
Go Back