CVE-2018-19296

Vulnerability

PHPMailer versions before 5.2.27 and 6.x before 6.0.6 contain an object injection vulnerability. The issue occurs when the library deserializes user-controllable input during email header parsing, allowing an attacker to inject arbitrary PHP objects. This affects applications that process untrusted data through PHPMailer's msgHTML() or similar methods that trigger deserialization. [1][2]

Exploitation

An attacker needs the ability to supply malicious input to PHPMailer's header processing functions, typically through crafted email content or headers. The attacker crafts a serialized payload that, when deserialized by PHPMailer, leads to object injection. No authentication or special network position is required if the application exposes PHPMailer to user-supplied data. [1]

Impact

Successful exploitation allows an attacker to inject arbitrary PHP objects, potentially leading to remote code execution (RCE), information disclosure, or other unintended behavior depending on available gadget chains in the application's environment. The attacker gains the ability to execute code at the privilege level of the web server or PHP process. [1][4]

Mitigation

Users should upgrade to PHPMailer version 5.2.27 or 6.0.6, which were released in November 2018 and contain the fix. No workarounds are known. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog. [2][4]