betr. "PHPMailer bringt eine böse Weihnachtsüberraschung"

A place for security related announcements and discussions - please check this forum frequently!
Der Zwerch
Posts: 526
Joined: Sat Jul 28, 2012 11:38 am
Location: Perle der Grafschaft > 127.0.0.1
Contact:

betr. "PHPMailer bringt eine böse Weihnachtsüberraschung"

Postby Der Zwerch » Tue Dec 27, 2016 8:59 am

Hallo zusammen,
ich wollte mal kurz fragen, ob das hier auch das CMSimle_XH 1.6.x betrifft?
Quelle: >>>klick<<<

Ich bin da technisch leider nicht auf der Höhe. Scheint aber nicht unwesentlich zu sein.

Grüße,
Franky
Hoster: Strato
Domains: 9 an der Zahl
CMS: CMSimple_XH, 7x 1.7.0, 1x 1.6.10

cmb
Posts: 11439
Joined: Tue Jun 21, 2011 11:04 am
Location: Mü-Sa, RLP, DE
Contact:

Re: betr. "PHPMailer bringt eine böse Weihnachtsüberraschung

Postby cmb » Tue Dec 27, 2016 11:39 am

Danke für die Info, Frank!

Engl. advisory: https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html.

The core of CMSimple_XH is not affected, as it doesn't use PHPMailer at all. I'm aware of two plugins that use PHPMailer, namely Advancedform_XH and the Wellrad Shop. I don't know whether the Wellrad Shop might be affected by this issue, but it seems that Advancedform_XH is not. However, apparantly Advancedform_XH has another severe vulnerability – I'll have to investigate more thoroughly.
Christoph M. Becker –Plugins for CMSimple_XH, but not for CMSimple 4+

Der Zwerch
Posts: 526
Joined: Sat Jul 28, 2012 11:38 am
Location: Perle der Grafschaft > 127.0.0.1
Contact:

Re: betr. "PHPMailer bringt eine böse Weihnachtsüberraschung

Postby Der Zwerch » Tue Dec 27, 2016 11:47 am

Hallo,
Besten Dank für die Rückmeldung :mrgreen:

Franky
Hoster: Strato
Domains: 9 an der Zahl
CMS: CMSimple_XH, 7x 1.7.0, 1x 1.6.10

cmb
Posts: 11439
Joined: Tue Jun 21, 2011 11:04 am
Location: Mü-Sa, RLP, DE
Contact:

Re: betr. "PHPMailer bringt eine böse Weihnachtsüberraschung

Postby cmb » Tue Dec 27, 2016 3:19 pm

I think I can give the all-clear: neither Advancedform_XH nor the Wellrad Shop are affected by this issue. Also, there doesn't seem to be an email header injection issue in Advancedform_XH.
Christoph M. Becker –Plugins for CMSimple_XH, but not for CMSimple 4+

Der Zwerch
Posts: 526
Joined: Sat Jul 28, 2012 11:38 am
Location: Perle der Grafschaft > 127.0.0.1
Contact:

Re: betr. "PHPMailer bringt eine böse Weihnachtsüberraschung

Postby Der Zwerch » Tue Dec 27, 2016 3:25 pm

Hallo,
Great +1 *thumbsup*
Hoster: Strato
Domains: 9 an der Zahl
CMS: CMSimple_XH, 7x 1.7.0, 1x 1.6.10

Holger
Site Admin
Posts: 2618
Joined: Mon May 19, 2008 7:10 pm
Location: Hessen, Germany
Contact:

Re: betr. "PHPMailer bringt eine böse Weihnachtsüberraschung

Postby Holger » Tue Dec 27, 2016 5:32 pm

AFAIK Newsletter_XH uses PHPMailer too.


Return to “Security”

Who is online

Users browsing this forum: No registered users and 1 guest