s.masugata has reported a vulnerability in PHP, which potentially can be exploited by malicious people to use it as an open mail relay.

The vulnerability is caused due to an input validation error in the "mb_send_mail()" function. This can be exploited to inject arbitrary headers in a mail sent via a script calling the "mb_send_mail()" function where the "To" parameter can be controlled by the attacker.

Solution
Update to version 5.1.0.
Further details available to Secunia VIM customers

Provided and/or discovered by
s.masugata

Changelog
Further details available to Secunia VIM customers

Original Advisory
The PHP Group:
http://www.php.net/release_5_1_0.php

s.masugata:
http://bugs.php.net/bug.php?id=35307

Deep Links
Links available to Secunia VIM customers