CVE-2006-7087

Vulnerability

The mail function in Dotdeb PHP versions before 5.2.0 Rev 3 is vulnerable to CRLF injection. The protection scheme meant to prevent header injection can be bypassed by including CRLF sequences (%0d%0a) in the query string, which is processed via the PHP_SELF variable [1].

Exploitation

An attacker can send a crafted HTTP request to a server running the vulnerable Dotdeb PHP version, embedding CRLF sequences in the query string. When the mail function is invoked, the PHP_SELF variable containing the injected sequence is used, allowing arbitrary email headers to be appended [1]. No authentication is required.

Impact

Successful exploitation enables an attacker to inject arbitrary email headers, potentially leading to email spoofing, content manipulation, or additional attacks such as SMTP injection if the mail transfer agent processes the injected headers [1].

Mitigation

Upgrade to Dotdeb PHP 5.2.0 Rev 3 or later, where the CRLF filtering in PHP_SELF is correctly applied [1]. No workaround is documented for unpatched versions.