Bug #17746 Updated: Injecting ASCII control characters into message header/body created with mail()

ID: 17746 Updated by: sesser@php.net Reported By: cliph@isec.pl -Status: Open +Status: Closed Bug Type: Mail related Operating System: Any PHP Version: 4.2.1 New Comment: This bug has been fixed in CVS. You can grab a snapshot of the CVS version at http://snaps.php.net/. In case this was a documentation problem, the fix will show up soon at http://www.php.net/manual/. In case this was a PHP.net website problem, the change will show up on the PHP.net site and on the mirror sites. Thank you for the report, and for helping us make PHP better. cvs commit message at: http://lists.php.net/article.php?group=php.cvs&article=12348 Previous Comments: ------------------------------------------------------------------------ [2002-06-13 12:40:38] cliph@isec.pl Injecting ASCII control characters into mail() arguments Arbitrary ASCII control characters may be injected into string arguments of mail() function. If mail() arguments are takeon from user's input it may give the user ability to alter message content including mail headers. Example of such a vulnerability: http://www.php.net/mailling-lists.php?maillist=rcpt@foo.bar%0aFrom:%20spammer@oh.ah%0a%0aMAIL%20BODY%0a.%0a&email=a :-) PHP should do content filtering before creating message body sent with "sendmail -t" command. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=17746&edit=1