Line 393 in the SendmailSend function in class.phpmailer.php has the vulnerable code. If the Sender property is set by the initiating script it is possible to execute arbitrary commands.

The Sender property is most typically set in the host application by reading the value of the e-mail field or comment forms, which is where most attack vectors will be found.

The solution of course is to properly escape the input with the escapeshellarg() or escapeshellcmd() functions.

above taken from http://larholm.com/2007/06/11/phpmailer-0day-remote-execution/

maybe it isn't necessary to escape this->sendmail, i didn't write the solution i only passed the solution on.

but either way, it's more secure having it there is it not? (and it certainly doesn't do any harm)

is this fixed in 2.3??