CVEs-PoC/2021/CVE-2021-3603.md

### [CVE-2021-3603](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3603)
![](https://img.shields.io/static/v1?label=Product&message=PHPMailer&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3C%206.5.0%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-829%20Inclusion%20of%20Functionality%20from%20Untrusted%20Control%20Sphere&color=brighgreen)

### Description

PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). If the $patternselect parameter to validateAddress() is set to 'php' (the default, defined by PHPMailer::$validator), and the global namespace contains a function called php, it will be called in preference to the built-in validator of the same name. Mitigated in PHPMailer 6.5.0 by denying the use of simple strings as validator function names.

### POC

#### Reference
- https://www.huntr.dev/bounties/1-PHPMailer/PHPMailer/

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/qquang/CTFs