CVE-2007-3778

Name of the Vulnerable Software and Affected Versions G/PGP Plugin versions 2.0 through 2.1dev before 20060912

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the messageSignedText parameter to the gpg check sign pgp mime function in gpg hook functions.php. A parameter value can be set in the contents of an e-mail message.

Recommendations For G/PGP Plugin versions 2.0 through 2.1dev before 20060912, consider restricting access to the gpg check sign pgp mime function in gpg hook functions.php to minimize the risk of exploitation. Avoid using the messageSignedText parameter in the affected function until the issue is resolved.