NetSight
IP …
critical10.0Public exploit code

CVE-2008-5619

PHPMailer susceptible to arbitrary code execution

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.

Affected packages

EcosystemPackageAffectedFixed in
composerphpmailer/phpmailer< 5.2.105.2.10

Affected products

VendorProductAffected versions
RoundcubeWebmail
Versions 0.2.1, 0.2.3

Weakness classification

CWE-94

References