Old version of PHPMailer (not a security problem)

[citoyen]

The version of PHPMailer that is bundled with Zen-Cart is very old, and has security issues. My webhost reports that these holes were actively exploited, which caused them to shut down my site. I have successfully replaced the classes with updated versions, which appear to work fine.

[DrByte]

Which specific "security issues" are you referring to?
Which specific holes were exploited?

[citoyen]

I'm afraid I don't know exactly which security holes they were talking about and how they were exploited. My webhost reported that the class.phpmailer.php is version 1.73 and the class.smtp.php is version 1.02, while the newest version of both is 5.1.

[DrByte]

There is a known problem in the original class.phpmailer.php version 1.73 file that was originally published, but when we found out about it, we patched it ourselves, thus removing that vulnerability from Zen Cart.

[citoyen]

My webhost (domeneshop.no, one of Norway's largest hosts) provides some further info:

-----
The problems here are:The problems here are:

1) Zen Cart bundles an apparently unmodified PHPMailer 1.02
(class.smtp.php).

2) For the purpose of automated version recognition, Zen Cart's
home-patched class.phpmailer.php pretends to be a vulnerable
version of PHPMailer: 1.73.

Since the particular problem with PHPMailer 1.73 appears to be
patched, the version number should be increased, or the code
forked to e.g. "Zen Cart PHPMailer" and a separate version
number tree, in order to avoid confusion. The @version string in
the comments is unfortunately not helpful, since the proper
version strings remain unmodified.

The best by far would be to bundle the current version of
PHPMailer - our customers report that PHPMailer 5.1 works well
with Zen Cart.

For the record, we are very happy that someone has worked hard
with improving Zen Cart, which just a few months ago was a
piece of software we recommended our customers avoid, because of
the plethora of security problems related to the product.

1) Zen Cart bundles an apparently unmodified PHPMailer 1.02
(class.smtp.php).

2) For the purpose of automated version recognition, Zen Cart's
home-patched class.phpmailer.php pretends to be a vulnerable
version of PHPMailer: 1.73.

Since the particular problem with PHPMailer 1.73 appears to be
patched, the version number should be increased, or the code
forked to e.g. "Zen Cart PHPMailer" and a separate version
number tree, in order to avoid confusion. The @version string in
the comments is unfortunately not helpful, since the proper
version strings remain unmodified.

The best by far would be to bundle the current version of
PHPMailer - our customers report that PHPMailer 5.1 works well
with Zen Cart.

For the record, we are very happy that someone has worked hard
with improving Zen Cart, which just a few months ago was a
piece of software we recommended our customers avoid, because of
the plethora of security problems related to the product.