Vulnerability in Dotdeb Php
CVE-2006-7087
CRLF injection vulnerability in the mail function in Dotdeb PHP before 5.2.0 Rev 3 allows remote attackers to bypass the protection scheme and inject arbitrary email headers via CRLF sequences in the query string, which is processed via the PHP_SELF variable.
EPSS: 0.018 (76.1th percentile) — read the EPSS interpretation.
Affected products
- Dotdeb Dotdeb_php — versions 4.4, 4.4.3, 4.4.4
- N/a — versions n/a
References
- cve@mitre.org (x_refsource_MISC, Vendor Advisory)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (vdb-entry, x_refsource_VUPEN)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (Patch, vdb-entry, x_refsource_BID, Vendor Advisory)
- cve@mitre.org (Vendor Advisory, mailing-list, x_refsource_FULLDISC)