CVE-2002-0985: Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass sa...

Security readout for executives and security teams

This flaw affects very old PHP 4 deployments. A vulnerable application could let an attacker manipulate extra arguments passed from PHP mail() to the mail transfer agent, bypassing PHP safe mode restrictions and potentially changing mail handling or executing commands. Exposure is most likely in legacy systems still running PHP 4.x through 4.2.2, especially applications that call mail() with attacker-influenced additional parameters. Modern PHP versions are not identified as affected in the provided sources. Prioritize only if legacy PHP 4 exists. The business risk is potentially serious, but the exposure window is narrow and tied to obsolete PHP deployments and vulnerable mail() usage. Mitigation focus: Inventory and retire PHP 4.x through 4.2.2 deployments.; Apply relevant vendor PHP updates from Debian, Red Hat, SuSE, OpenPKG, or other platform advisories.; Review application mail() usage, especially the fifth argument..

Prepared

Jun 30, 2026, 04:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.