CVE-2006-1015

Argument injection vulnerability in certain PHP 3.x, 4.x, and 5.x applications, when used with sendmail and when accepting remote input for the additional_parameters argument to the mail function, allows remote attackers to read and create arbitrary files via the sendmail -C and -X arguments. NOTE: it could be argued that this is a class of technology-specific vulnerability, instead of a particular instance; if so, then this should not be included in CVE.

CVSS v2.0

6.4 MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N

EPSS

12.40% chance of exploitation in the next 30 days, 96th percentile

Published

2006-03-07

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/27334

References

• CVE Record
• NVD entry

Related

• CVE-2006-1014
• CVE-2006-1016
• CVE-2006-1013
• CVE-2006-1018
• CVE-2006-1012
• CVE-2006-1021