CVE-2007-3215: PHPMailer Shell command injection in phpmailer/phpmailer
Summary
CVE-2007-3215: PHPMailer Shell command injection. Affects phpmailer/phpmailer versions < 1.7.4. Fixed in 1.7.4. How to fix ↓
Also tracked for
- libphp-phpmailer · Debian:11
The same CVE-2007-3215 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpmailer/phpmailer is a popular open-source library used for sending emails via PHP. It provides a convenient and secure way to send email messages from PHP applications. However, versions before 1.7.4 are vulnerable to a shell command injection attack when configured to use sendmail.
Vulnerability Detail
The vulnerability, identified as CVE-2007-3215, allows remote attackers to execute arbitrary shell commands by exploiting shell metacharacters in the SendmailSend function in class.phpmailer.php. This vulnerability can be remotely exploited if the host application does not properly filter user-supplied data. The impact of this vulnerability is considered high.
How To Fix
Minimum fixed version
1.7.4
This is the first release that contains the fix.
composer require phpmailer/phpmailer:1.7.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately possible, it is advised to filter and validate user-supplied data before using it in the Sender property. This can help prevent the exploitation of the shell command injection vulnerability.
Conclusion
In conclusion, the phpmailer/phpmailer package versions before 1.7.4 are vulnerable to a shell command injection attack. It is crucial to update to the latest version or apply the recommended workarounds to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmailer/phpmailer →
FAQ
phpmailer/phpmailer is an open-source library used for sending emails from PHP applications. It provides a convenient and secure way to handle email communication.
The vulnerability allows remote attackers to execute arbitrary shell commands on the affected system. This can lead to unauthorized access, data leakage, or further compromise of the host application.
To fix this vulnerability, update the phpmailer/phpmailer package to version 1.7.4 or later. This update includes the necessary patches to mitigate the shell command injection vulnerability.
If updating the package is not immediately possible, you can filter and validate user-supplied data before using it in the Sender property. This can help prevent the exploitation of the shell command injection vulnerability.
You can find more information about this vulnerability in the National Vulnerability Database (NVD) entry: https://nvd.nist.gov/vuln/detail/CVE-2007-3215.
Related vulnerabilities
Recent vulnerabilities recorded for phpmailer/phpmailer.
