betr. "PHPMailer bringt eine böse Weihnachtsüberraschung"

[Der Zwerch]

Hallo zusammen,
ich wollte mal kurz fragen, ob das hier auch das CMSimle_XH 1.6.x betrifft?
Quelle: >>>klick<<<

Ich bin da technisch leider nicht auf der Höhe. Scheint aber nicht unwesentlich zu sein.

Grüße,
Franky

[cmb]

Danke für die Info, Frank!

Engl. advisory: https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html.

The core of CMSimple_XH is not affected, as it doesn't use PHPMailer at all. I'm aware of two plugins that use PHPMailer, namely Advancedform_XH and the Wellrad Shop. I don't know whether the Wellrad Shop might be affected by this issue, but it seems that Advancedform_XH is not. However, apparantly Advancedform_XH has another severe vulnerability – I'll have to investigate more thoroughly.

[Der Zwerch]

Hallo,
Besten Dank für die Rückmeldung

Franky

[cmb]

I think I can give the all-clear: neither Advancedform_XH nor the Wellrad Shop are affected by this issue. Also, there doesn't seem to be an email header injection issue in Advancedform_XH.

[Der Zwerch]

Hallo,
Great +1 *thumbsup*

[Holger]

AFAIK Newsletter_XH uses PHPMailer too.