Bug #17746: Injecting ASCII control characters into message header/body created with mail()

From: cliph@isec.pl Operating system: Any PHP version: 4.2.1 PHP Bug Type: Mail related Bug description: Injecting ASCII control characters into message header/body created with mail() Injecting ASCII control characters into mail() arguments Arbitrary ASCII control characters may be injected into string arguments of mail() function. If mail() arguments are takeon from user's input it may give the user ability to alter message content including mail headers. Example of such a vulnerability: http://www.php.net/mailling-lists.php?maillist=rcpt@foo.bar%0aFrom:%20spammer@oh.ah%0a%0aMAIL%20BODY%0a.%0a&email=a :-) PHP should do content filtering before creating message body sent with "sendmail -t" command. -- Edit bug report at http://bugs.php.net/?id=17746&edit=1 -- Fixed in CVS: http://bugs.php.net/fix.php?id=17746&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=17746&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=17746&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=17746&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=17746&r=support Expected behavior: http://bugs.php.net/fix.php?id=17746&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=17746&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=17746&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=17746&r=globals