RCE in Pear

CVE-2009-4023

Argument injection vulnerability in the sendmail implementation of the Mail::Send method (Mail/sendmail.php) in the Mail package 1.1.14 for PEAR allows remote attackers to read and write arbitrary files via a crafted $from parameter, a different vector than CVE-2009-4111.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.024 (82.3th percentile) — read the EPSS interpretation.

Affected products

  • Pear — versions 1.1.14
  • N/a — versions n/a

Weakness classification (CWE)

References