| Vulnerability Name: | CVE-2016-10045 (CCN-120141) | ||||||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2016-12-28 | ||||||||||||||||||||||||||||||||||||||||||||
| Published: | 2016-12-28 | ||||||||||||||||||||||||||||||||||||||||||||
| Updated: | 2021-09-30 | ||||||||||||||||||||||||||||||||||||||||||||
| Summary: | The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. Note: this vulnerability exists because of an incorrect fix for CVE-2016-10033. | ||||||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) 9.2 Critical (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:R)
6.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:F/RL:U/RC:R)
| ||||||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-77 | ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2016-10045 Source: MLIST Type: Mailing List, Patch [oss-security] 20161228 Re: PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033] Source: MISC Type: Exploit, Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.html Source: MISC Type: Exploit, Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html Source: CCN Type: PHPMailer - Worx Web site Worx International Inc. Source: CCN Type: Bugtraq mailing list, Wed, 28 Dec 2016 04:20:00 -0200 PHPMailer < 5.2.20 Remote Code Execution PoC 0day Exploit (CVE-2016-10045) (Bypass of the CVE-2016-1033 patch) Source: CCN Type: Full Disclosure mailing list, Wed, 28 Dec 2016 04:18:24 -0200 PHPMailer < 5.2.20 Remote Code Execution PoC 0day Exploit (CVE-2016-10045) (Bypass of the CVE-2016-1033 patch) Source: FULLDISC Type: Mailing List, Patch, Third Party Advisory 20161227 PHPMailer < 5.2.20 Remote Code Execution PoC 0day Exploit (CVE-2016-10045) (Bypass of the CVE-2016-1033 patch) Source: MISC Type: Exploit, Third Party Advisory http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection Source: BUGTRAQ Type: Third Party Advisory, VDB Entry 20161228 PHPMailer < 5.2.20 Remote Code Execution PoC 0day Exploit (CVE-2016-10045) (Bypass of the CVE-2016-1033 patch) Source: BID Type: Exploit, Third Party Advisory, VDB Entry 95130 Source: CCN Type: BID-95130 PHPMailer CVE-2016-10045 Incomplete Fix Remote Code Execution Vulnerability Source: SECTRACK Type: Third Party Advisory, VDB Entry 1037533 Source: CONFIRM Type: Third Party Advisory https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html Source: XF Type: UNKNOWN phpmailer-cve201610045-code-exec(120141) Source: CONFIRM Type: Patch, Vendor Advisory https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.20 Source: CONFIRM Type: Patch, Vendor Advisory https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities Source: MISC Type: Exploit, Patch, Third Party Advisory https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html Source: CCN Type: Packet Storm Security [12-28-2016] PHPMailer Remote Code Execution Source: CCN Type: Packet Storm Security [01-03-2017] PHPMailer / Zend-mail / SwiftMailer Remote Code Execution Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [12-27-2016] Source: EXPLOIT-DB Type: Exploit, Third Party Advisory, VDB Entry 40969 Source: EXPLOIT-DB Type: Third Party Advisory, VDB Entry 40986 Source: EXPLOIT-DB Type: Third Party Advisory, VDB Entry 42221 Source: CCN Type: WhiteSource Vulnerability Database CVE-2016-10045 | ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration 3: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||||||