Vulnerability Description
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Phpmailer Project | Phpmailer | < 5.2.18 |
| Wordpress | Wordpress | <= 4.7 |
| Joomla | Joomla\! | >= 1.5.0, <= 3.6.5 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-InjectioExploitThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2016/Dec/78Mailing ListPatchThird Party Advisory
- http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injectionExploitThird Party Advisory
- http://www.securityfocus.com/archive/1/539963/100/0/threadedBroken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/95108Broken LinkExploitThird Party Advisory
- http://www.securitytracker.com/id/1037533Broken LinkThird Party AdvisoryVDB Entry
- https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advThird Party Advisory
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18PatchVendor Advisory
- https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-201PatchVendor Advisory
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-ExploitPatchThird Party Advisory
- https://www.drupal.org/psa-2016-004Third Party Advisory
- https://www.exploit-db.com/exploits/40968/ExploitPatchThird Party Advisory
- https://www.exploit-db.com/exploits/40969/ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/40970/ExploitPatchThird Party Advisory
FAQ
What is CVE-2016-10033?
CVE-2016-10033 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (bac...
How severe is CVE-2016-10033?
CVE-2016-10033 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2016-10033?
Check the references section above for vendor advisories and patch information. Affected products include: Phpmailer Project Phpmailer, Wordpress Wordpress, Joomla Joomla\!.