Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 26 Dec 2016 15:55:59 +0100
From: Peter Bex <>
Subject: Re: PHPMailer < 5.2.18 Remote Code Execution

On Mon, Dec 26, 2016 at 03:46:50PM +0100, Hanno Böck wrote:
> Hi,
> Given I had plenty of time on the train to 33c3 I did a quick
> lookaround on what contains PHPMailer. As the details of the vuln
> aren't clear yet this doesn't necessarily mean they're vulnerable, just
> that they ship the affected code.

It looks like the vulnerability is due to a missing escaping of shell
arguments in the sender's e-mail address.  This commit seems to be
the one that fixes the bug:

So it depends on whether a web form allows one to control the "from"
mail address or not.

> Drupal doesn't contain PHPMailer, although mentioned in the advisory.
> But there are probably plugins and extensions using it. I also saw it
> used in some wordpress themes.

I noticed this Drupal module:
which has some sort of integration with the widely used mimemail module.
The linked module also uses PHPMailer.
There are undoubtedly more modules that do.

The LCMS system Chamilo also uses PHPMailer for sending mails internally.

Peter Bex

Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.