Veille CVE
CVE-2016-10033
9.8 Critique Exploitée activementCatalogue CISA KEV — PHPMailer Command Injection Vulnerability
Ajoutée le 07/07/2025 · Échéance de correction (agences US) : 28/07/2025
Action requise : Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 9.8 Critique | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 9.8 Critique | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | 7.5 Élevée | nvd@nist.gov (NVD) | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Faiblesses (CWE)
Références
- http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html ExploitThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2016/Dec/78 Mailing ListPatchThird Party Advisory
- http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection ExploitThird Party Advisory
- http://www.securityfocus.com/archive/1/539963/100/0/threaded Broken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/95108 Broken LinkExploitThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1037533 Broken LinkThird Party AdvisoryVDB Entry
- https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html Third Party Advisory
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18 PatchVendor Advisory
- https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities PatchVendor Advisory
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html ExploitPatchThird Party Advisory
- https://www.drupal.org/psa-2016-004 Third Party Advisory
- https://www.exploit-db.com/exploits/40968/ ExploitPatchThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/40969/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/40970/ ExploitPatchThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/40974/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/40986/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/41962/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/41996/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/42024/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/42221/ ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html ExploitThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2016/Dec/78 Mailing ListPatchThird Party Advisory
- http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection ExploitThird Party Advisory
- http://www.securityfocus.com/archive/1/539963/100/0/threaded Broken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/95108 Broken LinkExploitThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1037533 Broken LinkThird Party AdvisoryVDB Entry
- https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html Third Party Advisory
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18 PatchVendor Advisory
- https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities PatchVendor Advisory
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html ExploitPatchThird Party Advisory
- https://www.drupal.org/psa-2016-004 Third Party Advisory
- https://www.exploit-db.com/exploits/40968/ ExploitPatchThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/40969/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/40970/ ExploitPatchThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/40974/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/40986/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/41962/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/41996/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/42024/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/42221/ ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033 US Government Resource