CVE-2016-10045

high-risk
Published 2016-12-30

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.

Do I need to act?

!
93.4% chance of exploitation in next 30 days
EPSS score — higher than 7% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
3 public exploits available
40969, 40986, 42221
+
Fix available
Upgrade to: efde5edb3da8e1d257e030e3c2d922c4de6e5d09
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (3)

Affected Vendors

Wordpress Phpmailer Project Joomla

References (30)

Mailing List http://openwall.com/lists/oss-security/2016/12/28/1
Exploit http://packetstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.html
Exploit http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injectio...
Mailing List http://seclists.org/fulldisclosure/2016/Dec/81
Exploit http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection
Third Party Advisory http://www.securityfocus.com/archive/1/539967/100/0/threaded
Exploit http://www.securityfocus.com/bid/95130
Third Party Advisory http://www.securitytracker.com/id/1037533
Third Party Advisory https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-adv...
Patch https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.20
Patch https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-201...
Exploit https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-...
Exploit https://www.exploit-db.com/exploits/40969/
Third Party Advisory https://www.exploit-db.com/exploits/40986/
Third Party Advisory https://www.exploit-db.com/exploits/42221/
Mailing List http://openwall.com/lists/oss-security/2016/12/28/1
Exploit http://packetstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.html
Exploit http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injectio...
Mailing List http://seclists.org/fulldisclosure/2016/Dec/81
Exploit http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection
and 10 more references
61
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 20/34 · Moderate
Exposure 9/34 · Low