Description
CRLF injection vulnerability in the "User Profile: Send Email" feature in Geeklog 1.35 and 1.3.5sr1 allows remote attackers to obtain e-mail addresses by injecting a CRLF into the Subject field and adding a BCC mail header.
References
- geeklog-email-crlf-injection(9639) vdb-entry
- 5271 vdb-entry
- 20020719 Geeklog XSS and CRLF Injection mailing-list