CVE-2016-10045

Published: Dec 30, 2016Modified: May 6, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.

Affected (3)

Products: Phpmailer Project: Phpmailer · Wordpress: Wordpress · Joomla: Joomla!

Phpmailer Project

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Phpmailer Project Phpmailer	Before 5.2.20

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Wordpress Wordpress	Up to 4.7

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Joomla Joomla!	From 1.5.0 to 3.6.5

Related CWEs

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (30)

http://openwall.com/lists/oss-security/2016/12/28/1

Source: cve@mitre.org

Mailing ListPatch

http://packetstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.html

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2016/Dec/81

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection

Source: cve@mitre.org

ExploitThird Party Advisory

http://www.securityfocus.com/archive/1/539967/100/0/threaded

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/95130

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1037533

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html

Source: cve@mitre.org

Third Party Advisory

https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.20

Source: cve@mitre.org

PatchVendor Advisory

https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities

Source: cve@mitre.org

PatchVendor Advisory

https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html

Source: cve@mitre.org

ExploitPatchThird Party Advisory

https://www.exploit-db.com/exploits/40969/

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

https://www.exploit-db.com/exploits/40986/

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://www.exploit-db.com/exploits/42221/

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://openwall.com/lists/oss-security/2016/12/28/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatch

http://packetstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2016/Dec/81

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchThird Party Advisory

http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

http://www.securityfocus.com/archive/1/539967/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/95130

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1037533

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.20

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatchThird Party Advisory

https://www.exploit-db.com/exploits/40969/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

https://www.exploit-db.com/exploits/40986/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://www.exploit-db.com/exploits/42221/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

Timeline

No history available yet.