CVE-2008-5619: PHPMailer susceptible to arbitrary code execution
Summary
CVE-2008-5619: PHPMailer susceptible to arbitrary code execution. Affects phpmailer/phpmailer versions < 5.2.10. Fixed in 5.2.10. How to fix ↓
Also tracked for
- roundcube · Debian:11
The same CVE-2008-5619 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHPMailer is a popular email sending library for PHP. It provides a convenient way to send emails using various protocols and features. This vulnerability affects PHPMailer versions before 5.2.10. The vulnerability is present in the html2text.php file, which is used by PHPMailer and other applications like RoundCube Webmail, Mahara, and AtMail Open. The vulnerability allows remote attackers to execute arbitrary code by exploiting a flaw in the preg_replace function with the eval switch.
Vulnerability Detail
The vulnerability arises due to improper input validation in the html2text.php file. Attackers can craft malicious input that is processed by the preg_replace function with the eval switch. By exploiting this vulnerability, remote attackers can execute arbitrary code on the affected system. This can lead to various consequences, such as unauthorized access, data theft, or even complete compromise of the system.
How To Fix
Minimum fixed version
5.2.10
This is the first release that contains the fix.
composer require phpmailer/phpmailer:5.2.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the PHPMailer library is not immediately feasible, a temporary workaround is to disable or remove the vulnerable html2text.php file from the application. This will prevent the exploitation of the vulnerability. However, it is strongly advised to update the library to the latest version as soon as possible to ensure comprehensive security.
Conclusion
In conclusion, the PHPMailer library is susceptible to arbitrary code execution due to a vulnerability in the html2text.php file. It is crucial to update the library to version 5.2.10 or later to mitigate the risk. Alternatively, the vulnerable file can be temporarily disabled or removed. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmailer/phpmailer →
FAQ
PHPMailer is a popular email sending library for PHP. It provides a convenient way to send emails using various protocols and features.
Versions of PHPMailer before 5.2.10 are affected by this vulnerability.
The vulnerability allows remote attackers to execute arbitrary code on the affected system. This can lead to unauthorized access, data theft, or complete compromise of the system.
To fix this vulnerability, update the PHPMailer library to version 5.2.10 or later.
A temporary workaround is to disable or remove the vulnerable html2text.php file from the application.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpmailer/phpmailer.
