Remote code execution in PHPMailer
### Impact The `mailSend` function in the default `isMail` transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted `Sender` property. ### Patches Fixed in 5.2.18 ### Workarounds Filter and validate user input before passing it to internal functions. ### References https://nvd.nist.gov/vuln/detail/CVE-2016-10033 Related to a follow-on issue in https://nvd.nist.gov/vuln/detail/CVE-2016-10045 ### For more information If you have any questions or comments about this advisory: * Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2016-10033US | critical9.8OT kritisch | KEV | ||
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrar… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.htmlWEB
- http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.htmlWEB
- http://seclists.org/fulldisclosure/2016/Dec/78WEB
- http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injectionWEB
- https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.htmlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2016-10033.yamlWEB
- https://github.com/PHPMailer/PHPMailerPACKAGE
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18WEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan