CVEvulnerability

CVE-2002-0985

7.5 HIGH Published 2002-09-24 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2002-09-24
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-88

Description

Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g. sendmail) in the 5th argument to mail(), altering MTA behavior and possibly executing commands.

Affected configurations

• php php (>= 4.0 <= 4.2.2) • openpkg openpkg 1.1 • openpkg openpkg 1.2

Related

Weakness · CWE (1)

  • CWE-88 Improper Neutralization of Argument Delimiters in a Command weakness

Referenced by CWE · observed example (1)

  • CWE-88 Improper Neutralization of Argument Delimiters in a Command weakness

References