php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #12178 ext/standard/mail.c insecurity
Submitted: 2001-07-15 13:14 UTC Modified: 2001-11-30 04:26 UTC
From: sintes at nfrance dot com Assigned:
Status: Closed Package: Mail related
PHP Version: 4.0.6 OS: All UNIX
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: sintes at nfrance dot com
New email:
PHP Version: OS:

 

 [2001-07-15 13:14 UTC] sintes at nfrance dot com 
ext/standard/mail.c is potentialy insecure.

>extra_cmd = (*argv[4])->value.str.val;
>strcat (sendmail_cmd, extra_cmd);
>sendmail = popen(sendmail_cmd, "w");

So it is possible to use extra_cmd to gain shell access.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2001-11-30 04:26 UTC] derick@php.net 
This was fixed a long time ago. (on 2001/07/05 08:47:37)
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Fri Apr 26 14:01:29 2024 UTC