betr. "PHPMailer bringt eine böse Weihnachtsüberraschung"

A place for security related announcements and discussions - please check this forum frequently!
Post Reply
Der Zwerch
Posts: 608
Joined: Sat Jul 28, 2012 11:38 am
Location: Perle der Grafschaft > 127.0.0.1

betr. "PHPMailer bringt eine böse Weihnachtsüberraschung"

Post by Der Zwerch » Tue Dec 27, 2016 8:59 am

Hallo zusammen,
ich wollte mal kurz fragen, ob das hier auch das CMSimle_XH 1.6.x betrifft?
Quelle: >>>klick<<<

Ich bin da technisch leider nicht auf der Höhe. Scheint aber nicht unwesentlich zu sein.

Grüße,
Franky

cmb
Posts: 14225
Joined: Tue Jun 21, 2011 11:04 am
Location: Bingen, RLP, DE
Contact:

Re: betr. "PHPMailer bringt eine böse Weihnachtsüberraschung

Post by cmb » Tue Dec 27, 2016 11:39 am

Danke für die Info, Frank!

Engl. advisory: https://legalhackers.com/advisories/PHP ... -Vuln.html.

The core of CMSimple_XH is not affected, as it doesn't use PHPMailer at all. I'm aware of two plugins that use PHPMailer, namely Advancedform_XH and the Wellrad Shop. I don't know whether the Wellrad Shop might be affected by this issue, but it seems that Advancedform_XH is not. However, apparantly Advancedform_XH has another severe vulnerability – I'll have to investigate more thoroughly.
Christoph M. Becker – Plugins for CMSimple_XH

Der Zwerch
Posts: 608
Joined: Sat Jul 28, 2012 11:38 am
Location: Perle der Grafschaft > 127.0.0.1

Re: betr. "PHPMailer bringt eine böse Weihnachtsüberraschung

Post by Der Zwerch » Tue Dec 27, 2016 11:47 am

Hallo,
Besten Dank für die Rückmeldung :mrgreen:

Franky

cmb
Posts: 14225
Joined: Tue Jun 21, 2011 11:04 am
Location: Bingen, RLP, DE
Contact:

Re: betr. "PHPMailer bringt eine böse Weihnachtsüberraschung

Post by cmb » Tue Dec 27, 2016 3:19 pm

I think I can give the all-clear: neither Advancedform_XH nor the Wellrad Shop are affected by this issue. Also, there doesn't seem to be an email header injection issue in Advancedform_XH.
Christoph M. Becker – Plugins for CMSimple_XH

Der Zwerch
Posts: 608
Joined: Sat Jul 28, 2012 11:38 am
Location: Perle der Grafschaft > 127.0.0.1

Re: betr. "PHPMailer bringt eine böse Weihnachtsüberraschung

Post by Der Zwerch » Tue Dec 27, 2016 3:25 pm

Hallo,
Great +1 *thumbsup*

Holger
Site Admin
Posts: 3470
Joined: Mon May 19, 2008 7:10 pm
Location: Hessen, Germany

Re: betr. "PHPMailer bringt eine böse Weihnachtsüberraschung

Post by Holger » Tue Dec 27, 2016 5:32 pm

AFAIK Newsletter_XH uses PHPMailer too.

Post Reply