PHP mb_send_mail() Function Parameter Security Bypass

low Nessus Plugin ID 17716

Language:

Synopsis

The remote web server uses a version of PHP that is affected by a security bypass vulnerability.

Description

According to its banner, the version of PHP installed on the remote host is affected by a flaw that allows an attacker to gain unauthorized privileges. When used with sendmail and when accepting remote input for the additional_parameters argument to the mb_send_mail function, it is possible for context-dependent attackers to read and create arbitrary files.

Solution

There is no known solution at this time.

Plugin Details

Severity: Low

ID: 17716

File Name: php_sendmail_argument_injection.nasl

Version: 1.9

Type: remote

Family: CGI abuses

Published: 11/18/2011

Updated: 5/31/2024

Configuration: Enable thorough checks

Supported Sensors: Nessus

Enable CGI Scanning: true

Risk Information

VPR

Risk Factor: Medium

Score: 4.2

CVSS v2

Risk Factor: Low

Base Score: 3.2

Temporal Score: 2.9

Vector: CVSS2#AV:L/AC:L/Au:S/C:P/I:P/A:N

Vulnerability Information

CPE: cpe:/a:php:php

Required KB Items: www/PHP, Settings/PCI_DSS

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Ease: No exploit is required

Vulnerability Publication Date: 2/28/2006

Reference Information

CVE: CVE-2006-1014

BID: 16878

Detections

Analytics