Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Email Header Injection - Vulnerability Database

Email Header Injection

Description

One of the scans performed by Invicti has generated an Email Header Injection Alert. This caused an email to be sent from your website to Invicti OOB.

Remediation

You need to restrict CR(0x13) and LF(0x10) from the user input. Check references for more information about fixing this vulnerability.

References

Email Injection
PHP mail() Header Injection Through Subject and To Parameters

Related Vulnerabilities

Deserialization of Untrusted Data (Java JSON Deserialization) JsonIO High
Common tags: Abuse Of Functionality Acumonitor
XML external entity injection (variant) High
Common tags: Abuse Of Functionality Acumonitor
Deserialization of Untrusted Data (Java Object Deserialization) High
Common tags: Abuse Of Functionality Acumonitor
Deserialization of Untrusted Data (Java JSON Deserialization) Fastjson High
Common tags: Abuse Of Functionality Acumonitor
Deserialization of Untrusted Data (Java JSON Deserialization) Jackson High
Common tags: Abuse Of Functionality Acumonitor

Severity

High

Classification

CWE-20
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Abuse Of Functionality
Acumonitor