VDB
CVE-2016-10033
CVE-2016-10033
PUBLISHED
KEV
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
EPSS 94.44% · 100.0th percentile
Risk Scores
EPSS Score
94.44%
100.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:Pro:16.04:LTS | libphp-phpmailer | 0, 5.2.10+dfsg-1, 5.2.14+dfsg-1 |
Timeline
- CVE Published
- Dec 26, 2016 PoC Published
- Dec 27, 2016 PoC Published
- Dec 28, 2016 PoC Published
- Dec 29, 2016 PoC Published
- Jan 4, 2017 PoC Published
- Apr 26, 2017 PoC Published
- May 4, 2017 PoC Published
- May 5, 2017 PoC Published
- May 12, 2017 PoC Published
- May 17, 2017 PoC Published
- Jun 22, 2017 PoC Published
References
- https://ubuntu.com/security/CVE-2016-10033 third-party-advisory
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html third-party-advisory
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html third-party-advisory
- http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html third-party-advisory
- http://seclists.org/fulldisclosure/2016/Dec/78 third-party-advisory
- https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html third-party-advisory
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18 third-party-advisory
- https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities third-party-advisory
- https://www.drupal.org/psa-2016-004 third-party-advisory
- https://www.exploit-db.com/exploits/40968/ third-party-advisory
- https://www.exploit-db.com/exploits/40970/ third-party-advisory
- https://ubuntu.com/security/notices/USN-5956-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2016-10033 third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog third-party-advisory