CVE-2007-3215 PHPMailer Shell command injection
Remote attackers can execute arbitrary shell commands in PHPMailer when configured to use sendmail, requiring immediate library upgrades.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2007-3215?
CVE-2007-3215 is a medium-severity command injection vulnerability in n/a, published on 14 Jun 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PHPMailer 1.7, when configured to use sendmail, allows remote attackers to execute arbitrary shell commands via shell metacharacters in the SendmailSend function in class.phpmailer.php.
Which versions are affected by CVE-2007-3215?
2 open source packages ship an affected version, including phpmailer/phpmailer. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
phpmailer/phpmailer Packagist | All versions | 1.7.4 |
phpmailer/phpmailer Packagist | All versions | 1.7.4 |
Products include Phpmailer Phpmailer.
How do I fix CVE-2007-3215?
Upgrade phpmailer/phpmailer to 1.7.4 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2007-3215 being exploited?
There is no known exploitation of CVE-2007-3215 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2007-3215, DSA-1315-1, GHSA-6h78-85v2-mmch.