PHPMailer hack prevention

Question

I have been in conversation with a fellow web developer on whose servers I am doing some client work. Part of the current project is to add an email sending system from a web based form to my clients email via PHPMailer.

I have used PHPMailer repeatedly with no issues whatsoever, however, this developer has said to me that they do not want PHPMailer on the server due to having found previous instances on their server of PHPMailer being 'hacked'.

Please note that with all form to email systems I use I do believe I fully escape and clean the input strings as far as possible.

I'm asking here:

1. Is hacking PHPMailer version 5.2.8 specifically even possible?
2. How is this possible?
3. What can be done to secure PHPMailer in these instances?

Is there a halfway clear way that the above script could be hacked or otherwise hijacked by a hacker or similar?

Please note: all $member array values are from a database and have already been pre-cleaned.

require "PHPMailerAutoload.php"; ///version 5.2.8

        $message = "The following enquiry about " . $member['bizname'] . " was sent to " . $member['contname'] . " :
    Enquirer's Name: " . $name . ",
    Enquirer's Address: 
         " . $addr1 . "
         " . $addr2 . "
         " . $addr3 . "
         " . $postcode . "
    Telephone Number: " . $tel . ",
    Email address: " . $email . ",
    Dates they are interested in: " . $dates . ",
    Comments: " . $comments . ".

    NOTE: This is an automatic notification email for your records.
    Please do not reply to this email.
        ";

         $mail           = new PHPMailer();
        $mail->Host     = "localhost";
        $mail->WordWrap = 78;
        $mail->Mailer   = "smtp"; 
        $mail->From     = "server@website.co.uk";
        $mail->FromName = "Website Server";

///this is the client email and would not change.
        $mail->AddAddress("static@email-address.co.uk"); 
        $mail->Subject = $member['bizname'] . " Website Enquiry";
        $mail->Body    = $message;
        if (!$mail->Send()) {
            $dispmsg = "Mailer 1 error: " . $mail->ErrorInfo;
        } else {
            $dispmsg = "Your email has been sent to " . $member['bizname'] . " who will be in touch with you shortly.";
        }
    ////////////end email 1

Answer 1

is hacking PHPMailer version 5.2.8 specifically even possible? How is this possible?

That's really hard to say. If you use external libraries there is always a chance that they contain vulnerabilities, but the same is true for your custom code (and nobody is going to check that for vulnerabilities).

I didn't find any public disclosures for that version, so that's good.

The last ones also seem to be quite old (input validation issues in 1.7.3, code exec in 1.7, DOS in 1.7.2, email injection in 2012).

what can be done to secure PHPMailer in these instances?

• You could look at the PHPMailer code yourself, and try to find vulnerabilities (the main class is only 3.5k lines, and a lot of it are comments).
• You should only put those files in an open directory that are needed (ie don't include the test/example files).
• You could also use an application firewall/intrusion detection system such as mod_security to prevent the exploitation of possible vulnerabilities.
• And you should always use the latest version, which seems to be 5.2.9, not 5.2.8.

Misc

• your indentation and spacing is off, which makes your code a bit harder to read.
• don't shorten variable names. For example, displayMessage is easier to read than dispmsg.
• you didn't include the actual echoing of $dispmsg, but if $member['bizname'] is user supplied and $dispmsg not sanitized, your code would be open to XSS.
• having // end something comments is a sign of bad design. Your code should be organized in a way that it is obvious when something ends. That means extracting functionality into functions, and avoiding deep nesting.