UBUNTU-CVE-2016-10033

Dashboard / Vulnerabilities / UBUNTU-CVE-2016-10033

UBUNTU-CVE-2016-10033

Summary:

Details: The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

References: https://ubuntu.com/security/CVE-2016-10033, https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html, https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html, http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html, http://seclists.org/fulldisclosure/2016/Dec/78, https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html, https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18, https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities, https://www.drupal.org/psa-2016-004, https://www.exploit-db.com/exploits/40968/, https://www.exploit-db.com/exploits/40970/, https://ubuntu.com/security/notices/USN-5956-1, https://www.cve.org/CVERecord?id=CVE-2016-10033, https://www.cisa.gov/known-exploited-vulnerabilities-catalog