GitHub Advisoryadvisory · Packagist

GHSA-mj5r-x73q-fjw6 SPEmailHandler-PHP has Potential Abuse for Sending Arbitrary Emails

HIGH Published 2024-11-27 Modified 2024-12-02 Official page ↗
Aliases
CVE-2024-53860
Ecosystem
Packagist
Packages
spencer14420/sp-php-email-handler
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Weaknesses
CWE-74
Reviewed
2024-11-27

Affected packages

• Packagist spencer14420/sp-php-email-handler: < 1.0.0 → fixed in 1.0.0

Description

Impact Messages sent using this script are vulnerable to abuse, as the script allows anybody to specify arbitrary email recipients and include user-provided content in confirmation emails. This could enable malicious actors to use your server to send spam, phishing emails, or other malicious content, potentially damaging your domain's reputation and leading to blacklisting by email providers. Patches Patched in version 1.0.0 by removing user-provided content from confirmation emails. All pre-release versions (alpha and beta) are vulnerable to this issue and should not be used. Workarounds There are no workarounds for this issue. Users must upgrade to version 1.0.0 to mitigate the vulnerability.

Related

Alias · CVE (1)

  • CVE-2024-53860 sp-php-email-handler is a PHP package for handling contact form submissions. vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References