CVE-2007-1718
PHP 4.0.0-4.4.6 and 5.0.0-5.2.1 - CRLF Injection via Mail Function Header Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2007-1718. PoCs published by Stefan Esser.
AI-analyzed exploit summary This exploit demonstrates an email-header-injection vulnerability in PHP's mail() function. By injecting arbitrary headers via CRLF sequences, an attacker can manipulate email content, potentially leading to spam or phishing attacks.
Description
CRLF injection vulnerability in the mail function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows remote attackers to inject arbitrary e-mail headers and possibly conduct spam attacks via a control character immediately following folding of the (1) Subject or (2) To parameter, as demonstrated by a parameter containing a "\r\n\t\n" sequence, related to an increment bug in the SKIP_LONG_HEADER_SEP macro.
Exploits (1)
This exploit demonstrates an email-header-injection vulnerability in PHP's mail() function. By injecting arbitrary headers via CRLF sequences, an attacker can manipulate email content, potentially leading to spam or phishing attacks.