Nessus Plugin #11444

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

PHP Mail Function Header Spoofing Vulnerability

Family:

CGI abuses

Category:

infos

Copyright:

(C) tony@libpcap.net

Summary:

Checks for version of PHP

Version:

$Revision: 1.7 $

Cve_id:

CAN-2002-0985

Bugtraq_id:

5562

Xrefs:

-

Description:

The remote host is running a version of PHP earlier than 4.2.2.

The mail() function does not properly sanitize user input.
This allows users to forge email to make it look like it is
coming from a different source other than the server.

Users can exploit this even if SAFE_MODE is enabled.

Solution : Contact your vendor for the latest PHP release.

Risk factor : Medium