MediumGHSA-8jc3-5p29-qgjxCVE-2006-5734

PHPMailer Local file inclusion

Published 2 Feb 2024 · Updated 2 Feb 2024

Affected package

phpmailer/phpmailerComposer
Affected
<5.2.0
Fixed in
5.2.0
Update to the fixed version for your release line, for example:composer require phpmailer/phpmailer:^5.2.0

Details

Impact

Arbitrary local file inclusion via the $lang property, remotely exploitable if host application passes unfiltered user data into that property. The 3 CVEs listed are applications that used PHPMailer that were vulnerable to this problem.

Patches

It's not known exactly when this was fixed in the host applications, but it was fixed in PHPMailer 5.2.0.

Workarounds

Filter and validate user-supplied data before use.

References

https://nvd.nist.gov/vuln/detail/CVE-2006-5734 https://nvd.nist.gov/vuln/detail/CVE-2007-3215 https://nvd.nist.gov/vuln/detail/CVE-2007-2021 Example exploit: https://www.exploit-db.com/exploits/14893

For more information

If you have any questions or comments about this advisory:

Is GHSA-8jc3-5p29-qgjx in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected phpmailer/phpmailer, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.