PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack

[cluster]

is whmcs affected by this security issue?

https://nvd.nist.gov/vuln/detail/CVE-2018-19296

https://nvd.nist.gov/vuln/detail/CVE-2020-36326

 

 

 

[string]

4 hours ago, cluster said:

https://nvd.nist.gov/vuln/detail/CVE-2020-36326

According to the file "/vendor/phpmailer/phpmailer/VERSION", WHMCS uses the version 6.1.5 which is not affected by CVE-2020-36326.

4 hours ago, cluster said:

https://nvd.nist.gov/vuln/detail/CVE-2018-19296

6.1.5 is not affected by this.

[cluster]

my whmcs 7.10.3  shows phpmailer v 6.0.7 ...

it's not yet possible to me update to the current 8.x due to problems with some modules which are not finished right now

do you think I can replace my 7.10.3 phpmailer folder with the folder of v 8.x?

[string]

3 hours ago, cluster said:

my whmcs 7.10.3  shows phpmailer v 6.0.7 ...

6.0.7 isn't affected by these CVEs 🙂

3 hours ago, cluster said:

do you think I can replace my 7.10.3 phpmailer folder with the folder of v 8.x?

Maybe that works. If you are forced to stay on WHMCS 7.10 and later on a security vulnerability becomes known, you can at least try that. If this does not work, it would be possible write a wrapper so that it still works (i.e. restore compatibility via custom PHP code). 

However, i wouldn't suggest that if you are not a dev. And even if you are a dev, the recommended way would be to keep WHMCS up to date. Even though I know how annoying the version cycle of WHMCS is.