Improper Neutralization of Argument Delimiters in a Command in PHP - CVE-2001-1246
Published: February 14, 2024 / Updated: June 10, 2025
Vulnerability identifier: #VU110548
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/U:Green
CVE-ID: CVE-2001-1246
CWE-ID: CWE-88
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vendor: PHP Group
Affected software:
PHP
PHP
Detailed vulnerability description
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail() function, which allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters.
How to mitigate CVE-2001-1246
Install update from vendor's website.
Sources
- http://www.iss.net/security_center/static/6787.php
- http://www.php.net/do_download.php?download_file=php-4.1.2.tar.gz
- http://online.securityfocus.com/archive/1/194425
- http://www.redhat.com/support/errata/RHSA-2002-102.html
- http://www.redhat.com/support/errata/RHSA-2002-129.html
- http://www.redhat.com/support/errata/RHSA-2003-159.html
- http://www.securityfocus.com/bid/2954