CVE-2017-7692

SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen call. It's possible to exploit this vulnerability to execute arbitrary shell commands on the remote server. The problem is in the Deliver_SendMail.class.php with the initStream function that uses escapeshellcmd() to sanitize the sendmail command before executing it. The use of escapeshellcmd() is not correct in this case since it doesn't escape whitespaces, allowing the injection of arbitrary command parameters. The problem is in -f$envelopefrom within the sendmail command line. Hence, if the target server uses sendmail and SquirrelMail is configured to use it as a command-line program, it's possible to trick sendmail into using an attacker-provided configuration file that triggers the execution of an arbitrary command. For exploitation, the attacker must upload a sendmail.cf file as an email attachment, and inject the sendmail.cf filename with the -C option within the "Options > Personal Informations > Email Address" setting.

• CWE-20

• http://openwall.com/lists/oss-security/2017/04/19/6Mailing List, Third Party Advisory
• http://openwall.com/lists/oss-security/2017/04/27/1
• http://www.debian.org/security/2017/dsa-3852
• http://www.securityfocus.com/bid/98067
• http://www.securitytracker.com/id/1038312
• https://legalhackers.com/advisories/SquirrelMail-Exploit-Remote-Code-Exec-CVE-2017-7692-Vuln.htmlExploit, Third Party Advisory
• https://security.gentoo.org/glsa/201709-13
• https://www.exploit-db.com/exploits/41910/
• http://openwall.com/lists/oss-security/2017/04/19/6Mailing List, Third Party Advisory
• http://openwall.com/lists/oss-security/2017/04/27/1
• http://www.debian.org/security/2017/dsa-3852
• http://www.securityfocus.com/bid/98067
• http://www.securitytracker.com/id/1038312
• https://legalhackers.com/advisories/SquirrelMail-Exploit-Remote-Code-Exec-CVE-2017-7692-Vuln.htmlExploit, Third Party Advisory
• https://security.gentoo.org/glsa/201709-13
• https://www.exploit-db.com/exploits/41910/

Published

Apr 20, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-7686Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier compo…
• CVE-2017-7687When handling a decoding failure for a malformed URL path of…
• CVE-2017-7688Apache OpenMeetings 1.0.0 updates user password in insecure …
• CVE-2017-7689A Command Injection vulnerability in Schneider Electric home…9.8
• CVE-2017-7690Proxifier for Mac before 2.19.2, when first run, allows loca…7.8
• CVE-2017-7691A code injection vulnerability exists in SAP TREX / Business…
• CVE-2017-7693Directory traversal vulnerability in viewer_script.jsp in Ri…
• CVE-2017-7694Remote Code Execution vulnerability in symphony/content/cont…
• CVE-2017-7695Unrestricted File Upload exists in BigTree CMS before 4.2.17…
• CVE-2017-7696SAP AS JAVA SSO Authentication Library 2.0 through 3.0 allow…
• CVE-2017-7697In libsamplerate before 0.1.9, a buffer over-read occurs in …5.5
• CVE-2017-7698A Use After Free in the pdf2swf part of swftools 0.9.2 and e…