CVE-2016-10033

critical-risk
Published 2016-12-30

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

Do I need to act?

!
94.5% chance of exploitation in next 30 days
EPSS score — higher than 6% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
!
9 public exploits available
41962, 41996, 42024 and 6 more
+
Fix available
Upgrade to: ed4e7ce8ad877a8f578139c491c256ab1933c7c9
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (3)

Affected Vendors

Wordpress Phpmailer Project Joomla

References (43)

Exploit http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html
Exploit http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injectio...
Mailing List http://seclists.org/fulldisclosure/2016/Dec/78
Exploit http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection
Broken Link http://www.securityfocus.com/archive/1/539963/100/0/threaded
Broken Link http://www.securityfocus.com/bid/95108
Broken Link http://www.securitytracker.com/id/1037533
Third Party Advisory https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-adv...
Patch https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18
Patch https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-201...
Exploit https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-...
Third Party Advisory https://www.drupal.org/psa-2016-004
Exploit https://www.exploit-db.com/exploits/40968/
Exploit https://www.exploit-db.com/exploits/40969/
Exploit https://www.exploit-db.com/exploits/40970/
Exploit https://www.exploit-db.com/exploits/40974/
Exploit https://www.exploit-db.com/exploits/40986/
Exploit https://www.exploit-db.com/exploits/41962/
Exploit https://www.exploit-db.com/exploits/41996/
Exploit https://www.exploit-db.com/exploits/42024/
and 23 more references
75
/ 100
critical-risk
Severity 32/34 · Critical
Exploitability 34/34 · Critical
Exposure 9/34 · Low