PT-2024-35958 · Unknown · Sp-Php-Email-Handler

Spencer14420 · Published 2024-11-27 · Updated 2024-11-28 · CVE-2024-53860

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: sp-php-email-handler versions prior to 1.0.0

Description: The sp-php-email-handler PHP package is vulnerable to abuse, allowing malicious actors to specify arbitrary email recipients and include user-provided content in confirmation emails. This could enable them to use the server to send spam, phishing emails, or other malicious content, potentially damaging the domain's reputation and leading to blacklisting by email providers.

Recommendations: For versions prior to 1.0.0, upgrade to version 1.0.0 to mitigate the vulnerability. As a temporary workaround is not available, it is essential to apply the upgrade as soon as possible. All pre-release versions, including alpha and beta, should not be used due to their vulnerability to this issue.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2024-53860

GHSA-MJ5R-X73Q-FJW6

Affected Products

Sp-Php-Email-Handler

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53860.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-53860 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mj5r-x73q-fjw6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53860 · Security Note
• https://github.com/Spencer14420/SPEmailHandler-PHP · Note
• https://github.com/Spencer14420/SPEmailHandler-PHP/security/advisories/GHSA-mj5r-x73q-fjw6 · Note
• https://twitter.com/CVEnew/status/1861887707183501576 · Twitter Post
• https://twitter.com/CveFindCom/status/1861886009660543133 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1862150214427021599 · Twitter Post
• https://github.com/Spencer14420/SPEmailHandler-PHP/commit/6f00dd0d44ff27889aed2980a5ba06e60d83549d · Note