Homepage
About Snyk

SQL Injection Affecting zetacomponents/mail package, versions <1.8.2

0.0
high

Snyk CVSS

    Attack Complexity High
    Confidentiality High
    Integrity High
    Availability High

    Threat Intelligence

    Exploit Maturity Mature
    EPSS 14.59% (96th percentile)
Expand this section
NVD
8.1 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PHP-ZETACOMPONENTSMAIL-70374
  • published 4 Dec 2017
  • disclosed 15 Nov 2017
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 15 Nov 2017

CVE-2017-15806 Open this link in a new tab
CWE-89 Open this link in a new tab

How to fix?

Upgrade zetacomponents/mail to version 1.8.2 or higher.

Overview

Affected versions of zetacomponents/mail are vulnerable to Arbitrary Code Execution.

A malicious user may pass arbitrary parameters to the sendmail binary when setting the returnPath property of ezcMail when using the ezcMailMtaTransport. In some situations, it is possible to use an e-mail address that contains -X/path/to/wwwroot/file.php" to write a file to the file system, that can then be accessed and run through domainname/file.php.

This is only possible if all of these conditions are true:

  • you use the ezcMailMtaTransport
  • your "sendmail" binary allows the -X flag to be set, which is not the case for exim4 and postfix, as they don't support that argument
  • your wwwroot is writable by the user your webserver is running at
  • the input to use for the ezcMailAddress that is assigned to the returnPath property is not properly escaped

References