PT-2001-2378 · Php · Php
CVE-2001-1246
·
Publicado
2001-06-30
·
Atualizado
2024-02-14
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
PHP versions 4.0.5 through 4.1.0
Description
The issue is related to the mail() function in PHP, where the 5th parameter is not properly cleansed in safe mode, allowing local users and possibly remote attackers to execute arbitrary commands via shell metacharacters.
Recommendations
For PHP versions 4.0.5 through 4.1.0, consider disabling the mail() function in safe mode until a patch is available, or restrict the use of the 5th parameter to prevent the execution of arbitrary commands.
Exploit
Correção
Argument Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Php