Miggo Logo
Miggo Vulnerability Database
→
CVE-2007-3215

CVE-2007-3215: PHPMailer Shell command injection

6.8

CVSS Score

Basic Information

CVE ID
CVE-2007-3215
GHSA ID
GHSA-6h78-85v2-mmch
EPSS Score
0.85662%
CWE
-
Published
2/2/2024
Updated
2/2/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
AV:N/AC:M/Au:N/C:P/I:P/A:P
Package NameEcosystemVulnerable VersionsFirst Patched Version
phpmailer/phpmailercomposer< 1.7.41.7.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability manifests in SendmailSend function where user-controlled Sender property is directly interpolated into a shell command string without proper escaping. Multiple sources (CVE description, PHPMailer advisory, and vTiger exploit analysis) explicitly show the vulnerable code pattern: 'sprintf("%s -oi -f %s -t", $this->Sendmail, $this->Sender)' without using escapeshellarg/cmd. This allows attackers to inject commands via Sender parameter when sendmail transport is used.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

P*PM*il*r ***or* *.*.*, w**n *on*i*ur** to us* s*n*m*il, *llows r*mot* *tt**k*rs to *x**ut* *r*itr*ry s**ll *omm*n*s vi* s**ll m*t****r**t*rs in t** S*n*m*ilS*n* *un*tion in `*l*ss.p*pm*il*r.p*p`. ### Imp**t S**ll *omm*n* inj**tion, r*mot*ly *xploit

Reasoning

T** vuln*r**ility m*ni**sts in `S*n*m*ilS*n*` *un*tion w**r* us*r-*ontroll** `S*n**r` prop*rty is *ir**tly int*rpol*t** into * s**ll *omm*n* strin* wit*out prop*r *s**pin*. Multipl* sour**s (*V* **s*ription, `P*PM*il*r` **visory, *n* `vTi**r` *xploit