Improper Neutralization of Argument Delimiters in a Command in PHP - CVE-2001-1246
Published: February 14, 2024 / Updated: June 10, 2025
Vulnerability identifier: #VU110548
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2001-1246
CWE-ID: CWE-88
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail() function, which allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters.
Affected software
PHP
How to mitigate CVE-2001-1246
Install update from vendor's website.
PHP - update to 4.1.1
Links to Public Exploits and PoC-codes
External References
- http://www.iss.net/security_center/static/6787.php
- http://www.php.net/do_download.php?download_file=php-4.1.2.tar.gz
- http://online.securityfocus.com/archive/1/194425
- http://www.redhat.com/support/errata/RHSA-2002-102.html
- http://www.redhat.com/support/errata/RHSA-2002-129.html
- http://www.redhat.com/support/errata/RHSA-2003-159.html
- http://www.securityfocus.com/bid/2954