News for hackers. Stuff that matters.

A comment on PHPMailer RCE.

Re:PHPMailer RCE by janci on Monday December 26, 2016 @11:40AM (#13258778)
If I understand, only implementations using "sendmail" (ie. not mail() or SMTP) are affected.
[ Parent | on HN ]
Re:PHPMailer RCE by DCoder on Monday December 26, 2016 @12:02PM (#13258871)
That's not correct, the added escapeshellarg() call is inside the mailSend() function, which sends mail through php's mail(). See [1].

[1]: https://github.com/PHPMailer/PHPMailer/blame/4835657cd639fbd...

[ Parent | on HN ]
Re:PHPMailer RCE by SwellJoe on Monday December 26, 2016 @12:12PM (#13258907)
But, if something comes into the mail server via SMTP, it's gonna be protected by the mail servers own defenses. Unless the MTA also has a similar vulnerability, it wouldn't be dangerous in the SMTP case. Right? Or are you saying just the PHP mail() function is similarly exploitable?
[ Parent | on HN ]
Re:PHPMailer RCE by DCoder on Monday December 26, 2016 @12:25PM (#13258955)
The parent post said "only implementations using sendmail (ie. not mail() or SMTP) are affected".

From my reading of the code, "only implementations using mail() (ie. not sendmail or SMTP) are affected".

[ Parent | on HN ]