PHPMailer Exploit – Remote Code Execution

Re:PHPMailer Exploit – Remote Code Execution by cdevs on Wednesday December 28, 2016 @09:16AM (#13270567)

We're jerks and just strip everything down to a-Z space .- and @ _ anything beyond that f u, extensions and 3rd party library or even core filters come out with these vulnerabilities all the time, at least we will know for sure what characters were passed in from the start though I'm sure most business NEED to support every wacky combination but I'll take the complaint over the hack any day.

[ Parent | on HN ]

Re:PHPMailer Exploit – Remote Code Execution by hartz on Wednesday December 28, 2016 @11:45AM (#13271684)

So you are one of those sites that reject email addresses with "+" in it?

[ Parent | on HN ]

Re:PHPMailer Exploit – Remote Code Execution by sethammons on Thursday December 29, 2016 @12:58AM (#13275895)

That's a less than ideal solution. As another comment mentioned, you are screwing over legit email addresses with things like +. Better is to use better tooling. For sending email, I would use SendGrid or an alternative.

[ Parent | on HN ]

Re:PHPMailer Exploit – Remote Code Execution by Piskvorrr on Thursday December 29, 2016 @09:18AM (#13277364)

[email protected] is not amused. Might as well say "we throw out every e-mail that contains the letter 'b', because Reasons. Makes us feel warm, fuzzy and secure."

[ Parent | on HN ]