PHPMailer Exploit – Remote Code Execution
TL;DR: PHPmailer fails to properly sanitize input. When configured to use CLI sendmail, this can lead to arbitrary command execution.<p>But then again, why would you send e-mail to just any address someone enters, without validating it for correctness? I know it is tough to validate all addresses according to RFC, but I&#x27;d rather block some legitimate users (which btw. probably know more about RFC than me and I&#x27;m sure can find a &quot;nicer&quot; e-mail address if they want to) than let some attacker use some vulnerability like this. Always whitelist valid input, never (just) blacklist it.<p>Also, I am baffled that frameworks I encountered never demanded from developer to specify <i>exactly</i> what kind of input it expects via POST &amp; co.. It is trivial to write a set of functions like this:<p><pre><code>    function input_post_email($field_name, $default_value)
    function input_post_string($field_name, $validation_regex, $default_value)
    ...
</code></pre>
The point here is that framework should <i>DEMAND</i> from developer to specify format of each and every input var it needs. It should be difficult to bypass these restrictions, to demotivate developers doing it.<p>This is a first thing I made in every PHP project I started. Combined with Content Security Policy and output filtering it&#x27;s... well, better than most other solutions. :)