CRLF Injection Vulnerability in cgiemail by hardsystems

CVE-2002-1575

What is CVE-2002-1575?

The cgiemail product from hardsystems is susceptible to CRLF injection, which enables attackers to exploit it as a spam proxy. By manipulating certain parameters, such as 'required-subject,' attackers can inject encoded newline (%0a) characters into the email headers, allowing them to change CC, BCC, and other fields in the generated email messages. This vulnerability poses significant risks to email integrity and can lead to unauthorized email distribution.

References