Vulnerability CVE-2016-10045

Vulnerability CVE-2016-10045

Published: 2016-12-30

Description:

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.

See advisories in our WLB2 database:

	Topic	Author	Date
High	PHPMailer 5.2.17 Remote Code Execution Exploit (python)	Dawid Golunski	30.12.2016
High	PHPMailer Sendmail Argument Injection	Spencer McIntyre	04.01.2017
High	PHPMailer / Zend-mail / SwiftMailer Remote Code Execution	PwnScriptum	04.01.2017
High	WordPress Core 4.6 Unauthenticated Remote Code Execution Full Advisory	Dawid Golunski	05.05.2017
High	PHPMailer < 5.2.20 with Exim MTA Remote Code Execution	phackt_ul	22.06.2017

Type:

CWE-77

(Improper Neutralization of Special Elements used in a Command ('Command Injection'))

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score	Impact Subscore	Exploitability Subscore
7.5/10	6.4/10	10/10

Exploit range	Attack complexity	Authentication
Remote	Low	No required
Confidentiality impact	Integrity impact	Availability impact
Partial	Partial	Partial

Affected software
Phpmailer project -> Phpmailer

References:

http://openwall.com/lists/oss-security/2016/12/28/1

http://packetstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.html

http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html

http://seclists.org/fulldisclosure/2016/Dec/81

http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection

http://www.securityfocus.com/archive/1/539967/100/0/threaded

http://www.securityfocus.com/bid/95130

http://www.securitytracker.com/id/1037533

https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html

https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.20

https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities

https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html

https://www.exploit-db.com/exploits/40969/

https://www.exploit-db.com/exploits/40986/

https://www.exploit-db.com/exploits/42221/

Vulnerability CVE-2016-10045

See advisories in our WLB2 database:

High

PHPMailer 5.2.17 Remote Code Execution Exploit (python)

High

PHPMailer Sendmail Argument Injection

High

PHPMailer / Zend-mail / SwiftMailer Remote Code Execution

High

WordPress Core 4.6 Unauthenticated Remote Code Execution Full Advisory

High

PHPMailer < 5.2.20 with Exim MTA Remote Code Execution

CWE-77

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

7.5/10

6.4/10

10/10

Remote

Low

No required

Partial

Partial

Partial

Affected software

References: