PHPMailer continues to be the world's most popular transport class, with an estimated 9 million users worldwide and With great power comes great responsibility.
An independent research uncovered a critical vulnerability in PHPMailer that could potentially be used by (unauthenticated) remote attackers to achieve remote arbitrary code execution in the context of the web server user and remotely compromise the target web application.
The same vulnerability was disclosed in CVE-2016-10033 (https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html) which was partially fixed in PHPMailer v5.2.17 however the latest stable version of PHPMailer (v5.2.19) is still vulnerable to this exploit. Although they have committed a fix to their github repository (https://github.com/PHPMailer/PHPMailer/pull/929), they have not pushed it to stable version.
More details on the exploit can be found at: http://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html
As always, if you need any kind of help we are just a ticket away :)
Wednesday, December 28, 2016