CVEvulnerability

CVE-2002-0986

5.0 MEDIUM Published 2002-09-24 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2002-09-24
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N

Description

The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail headers, and possibly use PHP as a "spam proxy."

Affected configurations

• php php 3.0.18 • php php 4.0 • php php 4.0.1 • php php 4.0.2 • php php 4.0.3 • php php 4.0.4 • php php 4.0.5 • php php 4.0.6 • php php 4.0.7 • php php 4.1.0 • php php 4.1.1 • php php 4.1.2 • php php 4.2.0 • php php 4.2.1 • php php 4.2.2

Related

Referenced by CWE · observed example (1)

  • CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences weakness

References