OSVDB ID: 33962 Title: PHP ext/filter FILTER_VALIDATE_EMAIL Newline Injection |
Info |
|
|
Dates |
||||
|
|
Description |
PHP's ext/filter extension contains a flaw that may allow a malicious user to inject specially crafted mail headers. The issue is triggered due to the FILTER_VALIDATE_EMAIL function using an incorrect regular expression which can be trivially bypassed. By using a newline character, an attacker could potentially use this to send unsolicited e-mail from the host. |
Classification |
Location:
Remote / Network Access
Attack Type: Input Manipulation Impact: Loss of Integrity Exploit: Exploit Public OSVDB: Web Related |
Solution |
Upgrade to version 5.2.3 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. |
Products |
|
References |
|
Credit |
|
hardenend-php.net - Hardened-PHP Project