FKIE_CVE-2007-3215

Vulnerability from fkie_nvd - Published: 2007-06-14 22:30 - Updated: 2026-06-16 22:41
Severity
Summary
PHPMailer 1.7, when configured to use sendmail, allows remote attackers to execute arbitrary shell commands via shell metacharacters in the SendmailSend function in class.phpmailer.php.
References
cve@mitre.orghttp://larholm.com/2007/06/11/phpmailer-0day-remote-execution/
cve@mitre.orghttp://osvdb.org/37206
cve@mitre.orghttp://osvdb.org/76139
cve@mitre.orghttp://seclists.org/fulldisclosure/2011/Oct/223
cve@mitre.orghttp://secunia.com/advisories/25626Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/25755
cve@mitre.orghttp://secunia.com/advisories/25758
cve@mitre.orghttp://securityreason.com/securityalert/2802
cve@mitre.orghttp://sourceforge.net/project/shownotes.php?release_id=517428&group_id=157374
cve@mitre.orghttp://www.debian.org/security/2007/dsa-1315
cve@mitre.orghttp://www.securityfocus.com/archive/1/471065/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/24417
cve@mitre.orghttp://www.vupen.com/english/advisories/2007/2161
cve@mitre.orghttp://www.vupen.com/english/advisories/2007/2267
cve@mitre.orghttp://yehg.net/lab/pr0js/advisories/%5BvTiger_5.2.1%5D_rce
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/34818
cve@mitre.orghttps://sourceforge.net/tracker/index.php?func=detail&aid=1734811&group_id=26031&atid=385707
af854a3a-2127-422b-91ae-364da2661108http://larholm.com/2007/06/11/phpmailer-0day-remote-execution/
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/37206
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/76139
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2011/Oct/223
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/25626Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/25755
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/25758
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/2802
af854a3a-2127-422b-91ae-364da2661108http://sourceforge.net/project/shownotes.php?release_id=517428&group_id=157374
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2007/dsa-1315
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/471065/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/24417
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2007/2161
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2007/2267
af854a3a-2127-422b-91ae-364da2661108http://yehg.net/lab/pr0js/advisories/%5BvTiger_5.2.1%5D_rce
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/34818
af854a3a-2127-422b-91ae-364da2661108https://sourceforge.net/tracker/index.php?func=detail&aid=1734811&group_id=26031&atid=385707
Impacted products
Vendor Product Version
phpmailer phpmailer 1.7
phpmailer phpmailer 1.7.1
phpmailer phpmailer 1.7.2
phpmailer phpmailer 1.7.3
phpmailer phpmailer 1.73
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phpmailer:phpmailer:1.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "65A453FF-9AC7-4A84-B1FA-735B38ABEC1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpmailer:phpmailer:1.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F3611829-7CF3-43B1-A8AC-979124BE9C79",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpmailer:phpmailer:1.7.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "7D5FB20E-ADCB-4F79-842A-40E692D384C3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpmailer:phpmailer:1.7.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "6BFE740D-FAD1-4A16-8F49-4FF2BE69C21C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpmailer:phpmailer:1.73:*:*:*:*:*:*:*",
              "matchCriteriaId": "7BF4FD90-8B03-4056-9CCD-1F587A163A38",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PHPMailer 1.7, when configured to use sendmail, allows remote attackers to execute arbitrary shell commands via shell metacharacters in the SendmailSend function in class.phpmailer.php."
    },
    {
      "lang": "es",
      "value": "PHPMailer 1.7, cuando est\u00e1 configurado para utilizar sendmail, permite a atacantes remotos ejecutar comandos del int\u00e9rprete de comandos (shell) a trav\u00e9s de los metacaracter\u00e9s del int\u00e9rprete de comandos en la funci\u00f3n SendmailSend en class.phpmailer.php."
    }
  ],
  "evaluatorImpact": "Successful exploitation requires that the PHP script using PHPMailer is configured to send e-mails with the Sendmail method, and that the script does not sanitise data before storing it in the Sender property.\r\n",
  "id": "CVE-2007-3215",
  "lastModified": "2026-06-16T22:41:17.177",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2007-06-14T22:30:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://larholm.com/2007/06/11/phpmailer-0day-remote-execution/"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/37206"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/76139"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://seclists.org/fulldisclosure/2011/Oct/223"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/25626"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/25755"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/25758"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/2802"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://sourceforge.net/project/shownotes.php?release_id=517428\u0026group_id=157374"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2007/dsa-1315"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/471065/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/24417"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2007/2161"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2007/2267"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://yehg.net/lab/pr0js/advisories/%5BvTiger_5.2.1%5D_rce"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34818"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://sourceforge.net/tracker/index.php?func=detail\u0026aid=1734811\u0026group_id=26031\u0026atid=385707"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://larholm.com/2007/06/11/phpmailer-0day-remote-execution/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/37206"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/76139"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://seclists.org/fulldisclosure/2011/Oct/223"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/25626"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/25755"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/25758"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/2802"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://sourceforge.net/project/shownotes.php?release_id=517428\u0026group_id=157374"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2007/dsa-1315"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/471065/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/24417"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2007/2161"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2007/2267"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://yehg.net/lab/pr0js/advisories/%5BvTiger_5.2.1%5D_rce"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34818"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://sourceforge.net/tracker/index.php?func=detail\u0026aid=1734811\u0026group_id=26031\u0026atid=385707"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.