Saint PwnScriptum, Who Wrote Code in the Mail Logs

Patron of contact forms, PHP's mail() function, and anyone who passes the user's address to the system sender.

Life

In late December 2016 Dawid Golunski disclosed PwnScriptum, a family of flaws in PHPMailer, SwiftMailer and Zend Mail. PHP's mail() function passed its fifth parameter to sendmail through a shell: with quoted-string syntax one could inject extra arguments, such as Sendmail's -X option, which writes a log file of your choice. By putting PHP code in the message body and the log in a web folder, a single contact form was enough to reach code execution.

Prayer

O Saint PwnScriptum, who turns a contact form into a shell, let our email addresses stay data and never arguments. Amen.

How to celebrate

Celebrated by updating PHPMailer to 5.2.18 and validating every address before handing it to mail().

A contact form without checks is mail that burns.