CVE-2008-5619 PHPMailer susceptible to arbitrary code execution
Remote attackers can execute arbitrary code via crafted input processed by the preg_replace function with the eval switch in the html2text.php library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2008-5619?
CVE-2008-5619 is a critical code injection vulnerability in Roundcube Webmail, published on 17 Dec 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
Weakness: CWE-94
Which versions are affected by CVE-2008-5619?
2 open source packages ship an affected version, including phpmailer/phpmailer. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
phpmailer/phpmailer Packagist | All versions | 5.2.10 |
phpmailer/phpmailer Packagist | All versions | 5.2.10 |
Products include Roundcube Webmail.
How do I fix CVE-2008-5619?
Upgrade phpmailer/phpmailer to 5.2.10 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2008-5619 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2008-5619 exists.
Public exploit code: 2 Exploit-DB entries.
Other vulnerabilities in Roundcube Webmail
Sources
Also known as DEBIAN-CVE-2008-5619, GHSA-v5c9-mmw9-829q.