SQL Injection Affecting zetacomponents/mail package, versions <1.8.2
Snyk CVSS
Attack Complexity
High
Confidentiality
High
Integrity
High
Availability
High
Threat Intelligence
Exploit Maturity
Mature
EPSS
14.59% (96th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-ZETACOMPONENTSMAIL-70374
- published 4 Dec 2017
- disclosed 15 Nov 2017
- credit Unknown
Introduced: 15 Nov 2017
CVE-2017-15806 Open this link in a new tabHow to fix?
Upgrade zetacomponents/mail
to version 1.8.2 or higher.
Overview
Affected versions of zetacomponents/mail
are vulnerable to Arbitrary Code Execution.
A malicious user may pass arbitrary parameters to the sendmail
binary when setting the returnPath property of ezcMail
when using the ezcMailMtaTransport
. In some situations, it is possible to use an e-mail address that contains -X/path/to/wwwroot/file.php"
to write a file to the file system, that can then be accessed and run through domainname/file.php
.
This is only possible if all of these conditions are true:
- you use the ezcMailMtaTransport
- your "sendmail" binary allows the -X flag to be set, which is not the case for exim4 and postfix, as they don't support that argument
- your wwwroot is writable by the user your webserver is running at
- the input to use for the ezcMailAddress that is assigned to the returnPath property is not properly escaped