CVE-2006-1014

CVE-2006-1014 describes an argument injection vulnerability in specific PHP 4.x and 5.x applications when using the mb_send_mail function with sendmail. Attackers can exploit this by providing malicious input to the additional_parameters argument, potentially leading to arbitrary file creation or reading. The vulnerability has a CVSS score of 3.2 (AV:L/AC:L/Au:S/C:P/I:P/A:N), indicating a low severity. It requires local access and user authentication, with low attack complexity, and primarily impacts confidentiality and integrity with no availability impact. While not listed on the KEV catalog or Hot List, an ExploitDB entry (EDB-27335) exists, suggesting proof-of-concept code is available. There is no evidence of active exploitation, and it has received minimal community discussion or media coverage.