2 ms·
Isn't this really a vulnerability of php's mail() function (or at least evidence of bad design). It shouldn't let itself call a shell command with arguments un
by ec109685 10y ago
Isn't this really a vulnerability of php's mail() function (or at least evidence of bad design). It shouldn't let itself call a shell command with arguments unescaped.
- tyingq 10y agoIt appears that it does escape shell commands. The issue is that PHPMailer had already escaped them. The exploit is exploiting the "double escape". The real issue to me is that unlike Perl and Python, PHP doesn't provide a way to spawn a process without invoking /bin/sh. If PHP had support for the various incantations of exec(), you could pass arguments without needing the shell.