6.8
CVSSv2

CVE-2007-3215

Published: 14/06/2007 Updated: 16/10/2018
CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6
VMScore: 605
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Summary

PHPMailer 1.7, when configured to use sendmail, allows remote malicious users to execute arbitrary shell commands via shell metacharacters in the SendmailSend function in class.phpmailer.php.

Vulnerable Product Search on Vulmon Subscribe to Product

phpmailer phpmailer 1.7.2

phpmailer phpmailer 1.7

phpmailer phpmailer 1.7.1

phpmailer phpmailer 1.7.3

phpmailer phpmailer 1.73

Vendor Advisories

Thor Larholm discovered that PHPMailer, as used by Moodle, did not correctly escape email addresses A local attacker with direct access to the Moodle database could exploit this to execute arbitrary commands as the web server user (CVE-2007-3215) ...
Debian Bug report logs - #429204 [CVE-2007-3163, CVE-2006-6978 etc] FCKEditor issues Package: knowledgeroot; Maintainer for knowledgeroot is (unknown); Reported by: Florian Weimer <fw@denebenyode> Date: Sat, 16 Jun 2007 10:03:06 UTC Severity: grave Tags: security Fixed in version knowledgeroot/0982-2 Done: Frank Ha ...
Debian Bug report logs - #429179 CVE-2007-3215: remote shell command execution Package: libphp-phpmailer; Maintainer for libphp-phpmailer is Debian PHP PEAR Maintainers <pkg-php-pear@listsaliothdebianorg>; Source for libphp-phpmailer is src:libphp-phpmailer (PTS, buildd, popcon) Reported by: Florian Weimer <fw@deneben ...
Debian Bug report logs - #428073 [CVE-2007-3140] remote SQL injection vulnerability in xmlrpcphp Package: wordpress; Maintainer for wordpress is Craig Small <csmall@debianorg>; Source for wordpress is src:wordpress (PTS, buildd, popcon) Reported by: Stefan Fritsch <sf@sfritschde> Date: Fri, 8 Jun 2007 16:45:01 UT ...