Remote code execution in PHPMailer

NGHIÊM TRỌNG 9.8ĐANG BỊ KHAI THÁC (CISA KEV)CVE-2016-10033 · GHSA-5f37-gxvh-23v6 · Công bố 30/12/2016 · cập nhật 17/06/2026

PHPMailer Command Injection Vulnerability. Đang bị khai thác thực tế: CISA đưa lỗ hổng này vào danh mục Known Exploited Vulnerabilities ngày 07/07/2025. Hãy vá các hệ thống bị ảnh hưởng ngay.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
phpmailer/phpmailer Packagist	`≥ 5.0.0, < 5.2.18`	`5.2.18`
joomla! joomla	`≥ 1.5.0, ≤ 3.6.5`	Chưa có bản vá
phpmailer phpmailer_project	`< 5.2.18`	`5.2.18`
wordpress wordpress	`≤ 4.7`	Chưa có bản vá

Mô tả

Impact

The mailSend function in the default isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted Sender property.

Patches

Fixed in 5.2.18

Workarounds

Filter and validate user input before passing it to internal functions.

References

https://nvd.nist.gov/vuln/detail/CVE-2016-10033 Related to a follow-on issue in https://nvd.nist.gov/vuln/detail/CVE-2016-10045

For more information

If you have any questions or comments about this advisory:

Open a private issue in the PHPMailer project

Mô tả của NVD

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

Tham khảo

PHPMailer/PHPMailer security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2016-10033 · ADVISORY
exploit-db.com/exploits/42221 · WEB
exploit-db.com/exploits/42024 · WEB
exploit-db.com/exploits/41996 · WEB
exploit-db.com/exploits/41962 · WEB
exploit-db.com/exploits/40986 · WEB
exploit-db.com/exploits/40974 · WEB
exploit-db.com/exploits/40970 · WEB
exploit-db.com/exploits/40969 · WEB
exploit-db.com/exploits/40968 · WEB
drupal.org/psa-2016-004 · WEB
cisa.gov/known-exploited-vulnerabilities-catalog · WEB
legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html · WEB
PHPMailer/PHPMailer · WEB
PHPMailer/PHPMailer release v5.2.18 · WEB
PHPMailer/PHPMailer · PACKAGE
FriendsOfPHP/security-advisories · WEB
developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html · WEB
packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html · WEB
packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html · WEB
seclists.org/fulldisclosure/2016/Dec/78 · WEB
rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection · WEB
securityfocus.com/archive/1/539963/100/0/threaded · Broken Link
securityfocus.com/bid/95108 · Broken Link
securitytracker.com/id/1037533 · Broken Link
exploit-db.com/exploits/40968 · Exploit
exploit-db.com/exploits/40969 · Exploit
exploit-db.com/exploits/40970 · Exploit
exploit-db.com/exploits/40974 · Exploit
exploit-db.com/exploits/40986 · Exploit
exploit-db.com/exploits/41962 · Exploit
exploit-db.com/exploits/41996 · Exploit
exploit-db.com/exploits/42024 · Exploit
exploit-db.com/exploits/42221 · Exploit
CISA KEV · CVE-2016-10033

Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.

Quét site miễn phí