CVE-2006-1014

Argument injection vulnerability in certain PHP 4.x and 5.x applications, when used with sendmail and when accepting remote input for the additional_parameters argument to the mb_send_mail function, allows context-dependent attackers to read and create arbitrary files by providing extra -C and -X arguments to sendmail. NOTE: it could be argued that this is a class of technology-specific vulnerability, instead of a particular instance; if so, then this should not be included in CVE.

CVSS v2.0

3.2 LOWAV:L/AC:L/Au:S/C:P/I:P/A:N

EPSS

1.33% chance of exploitation in the next 30 days, 69th percentile

Published

2006-03-07

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/27335

References

• CVE Record
• NVD entry

Related

• CVE-2006-1013
• CVE-2006-1015
• CVE-2006-1012
• CVE-2006-1016
• CVE-2006-1010
• CVE-2006-1018