PHPMailer Exploit – Remote Code Execution
TL;DR: PHPmailer fails to properly sanitize input. When configured to use CLI sendmail, this can lead to arbitrary command execution.<p>But then again, why would you send e-mail to just any address someone enters, without validating it for correctness? I know it is tough to validate all addresses according to RFC, but I'd rather block some legitimate users (which btw. probably know more about RFC than me and I'm sure can find a "nicer" e-mail address if they want to) than let some attacker use some vulnerability like this. Always whitelist valid input, never (just) blacklist it.<p>Also, I am baffled that frameworks I encountered never demanded from developer to specify <i>exactly</i> what kind of input it expects via POST & co.. It is trivial to write a set of functions like this:<p><pre><code>    function input_post_email($field_name, $default_value)
    function input_post_string($field_name, $validation_regex, $default_value)
    ...
</code></pre>
The point here is that framework should <i>DEMAND</i> from developer to specify format of each and every input var it needs. It should be difficult to bypass these restrictions, to demotivate developers doing it.<p>This is a first thing I made in every PHP project I started. Combined with Content Security Policy and output filtering it's... well, better than most other solutions. :)