Unscored severity · published May 22, 2009
CVE-2009-1777
CRLF injection vulnerability in FormMail.pl in Matt Wright FormMail 1.92, and possibly earlier, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response…
–
CVSS
2%
EPSS
No
On KEV
Description
CRLF injection vulnerability in FormMail.pl in Matt Wright FormMail 1.92, and possibly earlier, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the redirect parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Formmail · Matt Wright
1.92 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-1777
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-1777
Vendor Advisory
http://secunia.com/advisories/35068
www.securityfocus.com
http://www.securityfocus.com/archive/1/503446/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/34929
Exploit
http://www.ush.it/team/ush/hack-formmail_192/adv.txt
More from Formmail
–
CVE-2009-1776
Multiple cross-site scripting (XSS) vulnerabilities in FormMail.pl in Matt Wright FormMail 1.92, and possibly earlier, allow remote attackers to inject arbitrary web script or…
–
CVE-2002-1771
Matt Wright FormMail 1.9 and earlier allows remote attackers to send spam or anonymous e-mail by injecting a newline character followed by CC:, BCC:, or additional TO: fields in…
–
CVE-2002-2109
Matt Wright FormMail 1.9 and earlier allows remote attackers to bypass the HTTP_REFERER check and conduct unauthorized activities via (1) a blank referer, (2) a spoofed referer…
–
CVE-2001-0357
FormMail.pl in FormMail 1.6 and earlier allows a remote attacker to send anonymous email (spam) by modifying the recipient and message parameters
–
CVE-2000-0411
Matt Wright's FormMail CGI script allows remote attackers to obtain environmental variables via the env_report parameter