#VU110548 Improper Neutralization of Argument Delimiters in a Command in PHP - CVE-2001-1246
Published: February 14, 2024 / Updated: June 10, 2025
Vulnerability identifier: #VU110548
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/U:Green
CVE-ID: CVE-2001-1246
CWE-ID: CWE-88
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerable software:
PHP
PHP
Software vendor:
PHP Group
PHP Group
Description
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail() function, which allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters.
Remediation
Install update from vendor's website.
External links
- http://www.iss.net/security_center/static/6787.php
- http://www.php.net/do_download.php?download_file=php-4.1.2.tar.gz
- http://online.securityfocus.com/archive/1/194425
- http://www.redhat.com/support/errata/RHSA-2002-102.html
- http://www.redhat.com/support/errata/RHSA-2002-129.html
- http://www.redhat.com/support/errata/RHSA-2003-159.html
- http://www.securityfocus.com/bid/2954