Description

This script is possibly vulnerable to Email injection attacks.

Email injection is a security vulnerability that allows malicious users to send email messages using someone else's server without prior authorization. A malicious spammer could use this tactic to send large numbers of messages anonymously.

Remediation

You need to restrict CR(0x13) and LF(0x10) from the user input. Check references for more information about fixing this vulnerability.

References

PHP mail() Header Injection Through Subject and To Parameters

Related Vulnerabilities

WordPress Improper Input Validation Vulnerability (CVE-2011-4957)

PHP Improper Input Validation Vulnerability (CVE-2009-3291)

Perl Improper Input Validation Vulnerability (CVE-2010-4777)

PostgreSQL Improper Input Validation Vulnerability (CVE-2012-3489)

Squid Improper Input Validation Vulnerability (CVE-2014-7142)

Severity

High

Classification

CWE-20 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Tags

Abuse Of Functionality