9.8

CVE-2016-10033

Warnung
Exploit
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Phpmailer Project ≫ Phpmailer Version < 5.2.18
Wordpress ≫ Wordpress Version <= 4.7

07.07.2025: CISA Known Exploited Vulnerabilities (KEV) Catalog

PHPMailer Command Injection Vulnerability

Schwachstelle

PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.

Beschreibung

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 99.71% 1
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html
Third Party Advisory
Exploit
VDB Entry
http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html
Third Party Advisory
Exploit
VDB Entry
http://seclists.org/fulldisclosure/2016/Dec/78
Patch
Third Party Advisory
Mailing List
http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection
Third Party Advisory
Exploit
http://www.securityfocus.com/archive/1/539963/100/0/threaded
Third Party Advisory
Broken Link
VDB Entry
http://www.securityfocus.com/bid/95108
Third Party Advisory
Exploit
Broken Link
VDB Entry
http://www.securitytracker.com/id/1037533
Third Party Advisory
Broken Link
VDB Entry
https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html
Third Party Advisory
https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18
Patch
Vendor Advisory
https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities
Patch
Vendor Advisory
https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html
Patch
Third Party Advisory
Exploit
https://www.drupal.org/psa-2016-004
Third Party Advisory
https://www.exploit-db.com/exploits/40968/
Patch
Third Party Advisory
Exploit
VDB Entry
https://www.exploit-db.com/exploits/40969/
Third Party Advisory
Exploit
VDB Entry
https://www.exploit-db.com/exploits/40970/
Patch
Third Party Advisory
Exploit
VDB Entry
https://www.exploit-db.com/exploits/40974/
Third Party Advisory
Exploit
VDB Entry
https://www.exploit-db.com/exploits/40986/
Third Party Advisory
Exploit
VDB Entry
https://www.exploit-db.com/exploits/41962/
Third Party Advisory
Exploit
VDB Entry
https://www.exploit-db.com/exploits/41996/
Third Party Advisory
Exploit
VDB Entry
https://www.exploit-db.com/exploits/42024/
Third Party Advisory
Exploit
VDB Entry
https://www.exploit-db.com/exploits/42221/
Third Party Advisory
Exploit
VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033
US Government Resource