Vulnerability Description
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Phpmailer Project | Phpmailer | < 5.2.20 |
| Wordpress | Wordpress | <= 4.7 |
| Joomla | Joomla\! | >= 1.5.0, <= 3.6.5 |
Related Weaknesses (CWE)
References
- http://openwall.com/lists/oss-security/2016/12/28/1Mailing ListPatch
- http://packetstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-InjectioExploitThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2016/Dec/81Mailing ListPatchThird Party Advisory
- http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injectionExploitThird Party Advisory
- http://www.securityfocus.com/archive/1/539967/100/0/threadedThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/95130ExploitThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1037533Third Party AdvisoryVDB Entry
- https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advThird Party Advisory
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.20PatchVendor Advisory
- https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-201PatchVendor Advisory
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-ExploitPatchThird Party Advisory
- https://www.exploit-db.com/exploits/40969/ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/40986/Third Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/42221/Third Party AdvisoryVDB Entry
FAQ
What is CVE-2016-10045?
CVE-2016-10045 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction bet...
How severe is CVE-2016-10045?
CVE-2016-10045 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2016-10045?
Check the references section above for vendor advisories and patch information. Affected products include: Phpmailer Project Phpmailer, Wordpress Wordpress, Joomla Joomla\!.