Remote code execution in PHPMailer
### Impact The `mailSend` function in the default `isMail` transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted `Sender` property. ### Patches Fixed in 5.2.18 ### Workarounds Filter and validate user input before passing it to internal functions. ### References https://nvd.nist.gov/vuln/detail/CVE-2016-10033 Related to a follow-on issue in https://nvd.nist.gov/vuln/detail/CVE-2016-10045 ### For more information If you have any questions or comments about this advisory: * Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2016-10033US | critical9.8OT critical | KEV | ||
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrar… | ||||
references
External citations — patches, advisories, analysis.
- http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.htmlWEB
- http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.htmlWEB
- http://seclists.org/fulldisclosure/2016/Dec/78WEB
- http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injectionWEB
- https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.htmlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2016-10033.yamlWEB
- https://github.com/PHPMailer/PHPMailerPACKAGE
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18WEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan