CVE-2008-5619 PHPMailer susceptible to arbitrary code execution
HighCVSS 10.0
EPSS 58.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phpmailer/phpmailer(Packagist) | < 5.2.10 | 5.2.10 |
| phpmailer/phpmailer(Packagist) | = v5.2.2 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.4 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.5 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.6 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.7 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.8 | No fix listed |
| phpmailer/phpmailer(Packagist) | = v5.2.9 | No fix listed |
| roundcube Webmail | = 0.2.1-alpha | No fix listed |
| roundcube Webmail | = 0.2.3-beta | No fix listed |
| debian/roundcube(Debian:12) | < 0.1.1-9 | 0.1.1-9 |
| debian/roundcube(Debian:13) | < 0.1.1-9 | 0.1.1-9 |
| debian/roundcube(Debian:14) | < 0.1.1-9 | 0.1.1-9 |
References
- Debian Security Tracker CVE-2008-5619 vendor-advisory
- bugs.debian.org issue-tracking
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- 7549 exploit
- 7553 exploit
- FEDORA-2008-11220 vendor-advisory
- FEDORA-2008-11234 vendor-advisory
- mahara.org
- 53893 vdb-entry
- sourceforge.net vendor-advisory
- trac.roundcube.net exploit
- trac.roundcube.net exploit
- [oss-security] 20081212 CVE Request - roundcubemail mailing-list
- github.com
- github.com
- 33145 third-party-advisory
- 33170 third-party-advisory vendor-advisory
- 34789 third-party-advisory
- 20081222 POC for CVE-2008-5619 (roundcubemail PHP arbitrary code injection) mailing-list
- ADV-2008-3418 vdb-entry
- ADV-2008-3419 vdb-entry