News Feed
Sections




News Archive
Looking for more information on how to do PHP the right way? Check out PHP: The Right Way

Hardened-PHP Project:
Dotdeb PHP Email Header Injection Vulnerability
November 14, 2006 @ 14:13:00

The Hardened PHP Project has released another vulnerability today for the Dotdeb PHP package repository software. The exploit allows for an email header injection.

It was discovered that the Dotdeb PHP packages are patched with a mail() protection patch that was originally created by Steve Bennett and is nowadays developed at choon.net. This patch adds an X-PHP-Script header to outgoing mails that contains the name of the server, the script and the calling IP.

An example of an attack via this issue would be injecting Bcc: headers into emails with sensitive information, copying them to themselves. The latest version of the package can be downloaded from their site. It is suggested that versions less than 5.2.0 Rev 3 upgrade immediately.

0 comments voice your opinion now!
dotdeb email header injection vulnerability advisory dotdeb email header injection vulnerability advisory


blog comments powered by Disqus

Similar Posts

Srdjan Vranac's Blog: Custom Repository with DIC in Symfony2

Hardened-PHP Project: WordPress Vulnerability Advisories (XSS & Trackbacks)

DreamInCode.com: Preventing PHP Mail(...) Header Injections

ServerGrove Blog: Spooling emails with Symfony2 on VPS and Shared Hosting

Zend Developer Zone: Quick Start Symfony DI (Dependency Injection) Tutorial


Community Events





Don't see your event here?
Let us know!


opinion list series threedevsandamaybe developer code interview release wordpress unittest testing language framework podcast introduction community refactor laravel install configure

All content copyright, 2014 PHPDeveloper.org :: info@phpdeveloper.org - Powered by the Solar PHP Framework