PHP Improper Neutralization of Argument Delimiters in a Command (Argument Injection) Vulnerability - CVE-2018-19518 - Vulnerability Database

PHP

PHP Improper Neutralization of Argument Delimiters in a Command (Argument Injection) Vulnerability - CVE-2018-19518

High

Reference: CVE-2018-19518

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2018-19518

Title: PHP Improper Neutralization of Argument Delimiters in a Command (Argument Injection) Vulnerability

Overview:

University of Washington IMAP Toolkit 2007f on UNIX as used in imap_open() in PHP and other products launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g. entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example if rsh is a link to ssh (as seen on Debian and Ubuntu systems) then the attack can use an IMAP server name containing a quot-oProxyCommandquot argument.