CVE-2016-10033
CRITICAL
9,8
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
HIGH
7,5
Source: [email protected]
Access Vector: network
Access Complexity: low
Authentication: none
Confidentiality: partial
Integrity: partial
Availability: partial
Description
AI Translation Available
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \' (backslash double quote) in a crafted Sender property.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,9446
Percentile
1,0th
Updated
EPSS Score Trend (Last 91 Days)
88
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
DraftCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Availability
Other
Potential Impacts:
Execute Unauthorized Code Or Commands
Alter Execution Logic
Read Application Data
Modify Application Data
Applicable Platforms
Languages:
Not Language-Specific, PHP
Exploit
PHPMailer < 5.2.18 - Remote Code Execution
VerifiedPHPMailer < 5.2.18 - Remote Code Execution
View Exploit Code →
Exploit
PHPMailer < 5.2.20 - Remote Code Execution
PHPMailer < 5.2.20 - Remote Code Execution
View Exploit Code →
Exploit
PHPMailer < 5.2.18 - Remote Code Execution
PHPMailer < 5.2.18 - Remote Code Execution
View Exploit Code →
Exploit
PHPMailer < 5.2.18 - Remote Code Execution
PHPMailer < 5.2.18 - Remote Code Execution
View Exploit Code →
Exploit
PHPMailer < 5.2.20 / SwiftMailer < 5.4.5-DEV / …
PHPMailer < 5.2.20 / SwiftMailer < 5.4.5-DEV / Zend Framework / zend-mail < 2.4.11 - 'AIO' 'PwnScriptum' Remote Code Execution
View Exploit Code →
Exploit
WordPress Core 4.6 - Remote Code Execution
WordPress Core 4.6 - Remote Code Execution
View Exploit Code →
Exploit
Vanilla Forums < 2.3 - Remote Code Execution
Vanilla Forums < 2.3 - Remote Code Execution
View Exploit Code →
Exploit
WordPress Plugin PHPMailer 4.6 - Host Header Command …
Verified Metasploit Framework (MSF)WordPress Plugin PHPMailer 4.6 - Host Header Command Injection (Metasploit)
View Exploit Code →
Exploit
PHPMailer < 5.2.20 with Exim MTA - Remote …
PHPMailer < 5.2.20 with Exim MTA - Remote Code Execution
View Exploit Code →
Application
Joomla\! by Joomla
Version Range Affected
From
1.5.0
(inclusive)
To
3.6.5
(inclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Wordpress by Wordpress
Version Range Affected
To
4.7
(inclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Phpmailer by Phpmailer Project
Version Range Affected
To
5.2.18
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:a:phpmailer_project:phpmailer:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016…
http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html
http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injecti…
https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-ad…
http://seclists.org/fulldisclosure/2016/Dec/78
https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18
https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-20…
https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016…
https://www.drupal.org/psa-2016-004
https://www.exploit-db.com/exploits/40968/
https://www.exploit-db.com/exploits/40969/
https://www.exploit-db.com/exploits/40970/
https://www.exploit-db.com/exploits/40974/
https://www.exploit-db.com/exploits/40986/
https://www.exploit-db.com/exploits/41962/
https://www.exploit-db.com/exploits/41996/
https://www.exploit-db.com/exploits/42024/
https://www.exploit-db.com/exploits/42221/
http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection
http://www.securityfocus.com/archive/1/539963/100/0/threaded
http://www.securityfocus.com/bid/95108
http://www.securitytracker.com/id/1037533
http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html
http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injecti…
https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-ad…
http://seclists.org/fulldisclosure/2016/Dec/78
https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18
https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-20…
https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016…
https://www.drupal.org/psa-2016-004
https://www.exploit-db.com/exploits/40968/
https://www.exploit-db.com/exploits/40969/
https://www.exploit-db.com/exploits/40970/
https://www.exploit-db.com/exploits/40974/
https://www.exploit-db.com/exploits/40986/
https://www.exploit-db.com/exploits/41962/
https://www.exploit-db.com/exploits/41996/
https://www.exploit-db.com/exploits/42024/
https://www.exploit-db.com/exploits/42221/
http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection
http://www.securityfocus.com/archive/1/539963/100/0/threaded
http://www.securityfocus.com/bid/95108
http://www.securitytracker.com/id/1037533