Tales from the wrong end
summary
PHPMailer contains two December 2016 remote code execution flaws that earn 9.8 CVSS ratings and get assigned CVE numbers; an unsafe use of PHP mail() passes a user-supplied From into the shell via the -f envelope flag, and locale-dependent shell escaping allows command injection. A public exploit appears before fixes, prompting release of 5.2.18 that forbids risky sender characters and adds tighter validation; migrating to SMTP submission avoids the shell risk and reduces exposure across millions of bundled installs.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:39Once upon a time...
- 1:40How did I end up here?
- 5:33PHPMailer Popularity
- 6:27Responsible disclosure
- 8:01CVE Numbers
- 10:11Type & Severity
- 11:36What was the issue?
- 14:32CVE-2016-10045
- 19:05Getting help
- 21:15Press & exposure
- 23:37Post-mortem
- 26:48Lessons learned
- 29:24Why be a maintainer?
- 34:30Questions
related talks
45mKnow Your Enemies: Live Exploit of a PHP Engine Security Breach
42mOops, there's someone in my package manager!
35mPHP is evil (Defensive programming)
59mThere's somebody in my package manager!
02h 18mWeb application security (Part 2)
28mUnveiling Remote Code Execution: How Vulnerabilities Lead to System Takeovers
47mExploring the New World : Remote Exploitation of SQLite and Curl
01h 01mHow hacking works - Web edition