CVE-2001-1246

PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail() function, which allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

9.72% chance of exploitation in the next 30 days, 95th percentile

Published

2002-06-25

Updated

2024-08-08

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/20985

References

• CVE Record
• NVD entry

Related

• CVE-2001-1244
• CVE-2001-1259
• CVE-2001-1243
• CVE-2001-1263
• CVE-2001-1212
• CVE-2001-1274