Vulnerability CVE-2016-10033

Vulnerability CVE-2016-10033

Published: 2016-12-30

Description:

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

See advisories in our WLB2 database:

	Topic	Author	Date
High	PHPMailer < 5.2.18 Remote Code Execution	Dawid Golunski	26.12.2016
High	PHPMailer 5.2.17 Remote Code Execution Exploit	opsxcq	27.12.2016
High	PHPMailer 5.2.17 Remote Code Execution Exploit (python)	Dawid Golunski	30.12.2016
High	PHPMailer Sendmail Argument Injection	Spencer McIntyre	04.01.2017
High	PHPMailer / Zend-mail / SwiftMailer Remote Code Execution	PwnScriptum	04.01.2017
High	WordPress 4.6 Unauthenticated Remote Code Execution (RCE) PoC Exploit	Dawid Golunski	03.05.2017
High	WordPress Core 4.6 Unauthenticated Remote Code Execution Full Advisory	Dawid Golunski	05.05.2017
High	Vanilla Forums <= 2.3 Remote Code Execution (RCE) PoC Exploit 0day	Dawid Golunski	12.05.2017
High	WordPress PHPMailer Host Header Command Injection	wvu	17.05.2017
High	PHPMailer < 5.2.20 with Exim MTA Remote Code Execution	phackt_ul	22.06.2017

Type:

CWE-77

(Improper Neutralization of Special Elements used in a Command ('Command Injection'))

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score	Impact Subscore	Exploitability Subscore
7.5/10	6.4/10	10/10

Exploit range	Attack complexity	Authentication
Remote	Low	No required
Confidentiality impact	Integrity impact	Availability impact
Partial	Partial	Partial

Affected software
Phpmailer project -> Phpmailer

References:

http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html

http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html

http://seclists.org/fulldisclosure/2016/Dec/78

http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection

http://www.securityfocus.com/archive/1/539963/100/0/threaded

http://www.securityfocus.com/bid/95108

http://www.securitytracker.com/id/1037533

https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html

https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18

https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities

https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html

https://www.drupal.org/psa-2016-004

https://www.exploit-db.com/exploits/40968/

https://www.exploit-db.com/exploits/40969/

https://www.exploit-db.com/exploits/40970/

https://www.exploit-db.com/exploits/40974/

https://www.exploit-db.com/exploits/40986/

https://www.exploit-db.com/exploits/41962/

https://www.exploit-db.com/exploits/41996/

https://www.exploit-db.com/exploits/42024/

https://www.exploit-db.com/exploits/42221/

Vulnerability CVE-2016-10033

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

See advisories in our WLB2 database:

High

High

High

High

High

High

High

High

High

High

CWE-77

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

7.5/10

6.4/10

10/10

Remote

Low

No required

Partial

Partial

Partial

Affected software

References: