Description

This detector identifies PHP command argument injection vulnerabilities in mail functions where user-controlled data can be passed to the additional_parameters argument. Attackers can exploit this to inject arbitrary command-line arguments into the underlying sendmail binary, potentially leading to command execution or email header manipulation.

Detection Strategy

• Scans PHP source code for calls to the mail() or mb_send_mail() functions

• Examines the additional_parameters argument to determine if it contains unsafe user input

• Reports a vulnerability when these functions are called with potentially dangerous values in the additional_parameters argument that could allow command injection

Vulnerable code example

<?php
// VULNERABLE: User input directly in mail() 5th parameter
function send_email() {
    mail("admin@example.com", "Subject", "Body", "", $_GET['params']);
}

// VULNERABLE: Superglobal assigned to variable then used in mb_send_mail()
function send_mb_email() {...

✅ Secure code example

<?php
// SAFE: Whitelist validation prevents command injection
function send_email() {
    $params = $_GET['params'] ?? '';
    // Only allow safe flag format: -f followed by valid email
    if (!preg_match('/^-f\s+[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/', $params)) {
        throw new InvalidArgumentException("Invalid mail parameters");
    }...