PT-2002-1991 · Php+1 · Php+1

CVE-2002-0985

·

Publicado

2002-09-24

·

Atualizado

2024-02-13

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: PHP versions 4.x through 4.2.2
Description: The issue allows attackers to bypass safe mode restrictions and modify command line arguments to the MTA, such as sendmail, in the 5th argument to the mail() function, potentially altering MTA behavior and executing commands.
Recommendations: For PHP versions 4.x through 4.2.2, consider disabling the mail() function until a patch is available to prevent potential command execution. Restrict access to the mail function to minimize the risk of exploitation. Avoid using the 5th argument in the mail() function until the issue is resolved.

Correção

Argument Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-88

Identificadores relacionados

CVE-2002-0985
DSA-168

Produtos afetados

Php
Sendmail