blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2001-1246

HIGH 7.5 CVSS 2.0
Published
June 30, 2001
Last modified
June 16, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-88
CVSS vector
AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail() function, which allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters.

Affected products and versions

  • PHP — From 4.0.5 (including) to 4.1.0 (including)

References

  • online.securityfocus.com http://online.securityfocus.com/archive/1/194425 Broken Link, Third Party Advisory, VDB Entry
  • www.iss.net http://www.iss.net/security_center/static/6787.php Broken Link, Patch, Vendor Advisory
  • www.php.net http://www.php.net/do_download.php?download_file=php-4.1.2.tar.gz Broken Link
  • www.redhat.com http://www.redhat.com/support/errata/RHSA-2002-102.html Broken Link
  • www.redhat.com http://www.redhat.com/support/errata/RHSA-2002-129.html Broken Link
  • www.redhat.com http://www.redhat.com/support/errata/RHSA-2003-159.html Broken Link
  • www.securityfocus.com http://www.securityfocus.com/bid/2954 Broken Link, Third Party Advisory, VDB Entry
  • nvd.nist.gov Official NVD record