CVE

Id
87527  
CVE No.
CVE-2016-10033  
Status
Candidate  
Description
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted Sender property.  
Phase
Assigned (20161222)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
763928 87527 CVE-2016-10033 BUGTRAQ:20161227 PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033]  View
763929 87527 CVE-2016-10033 URL:http://www.securityfocus.com/archive/1/archive/1/539963/100/0/threaded  View
763930 87527 CVE-2016-10033 EXPLOIT-DB:40968  View
763931 87527 CVE-2016-10033 URL:https://www.exploit-db.com/exploits/40968/  View
763932 87527 CVE-2016-10033 EXPLOIT-DB:40970  View
763933 87527 CVE-2016-10033 URL:https://www.exploit-db.com/exploits/40970/  View
763934 87527 CVE-2016-10033 FULLDISC:20161227 PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033]  View
763935 87527 CVE-2016-10033 URL:http://seclists.org/fulldisclosure/2016/Dec/78  View
763936 87527 CVE-2016-10033 MISC:http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html  View
763937 87527 CVE-2016-10033 MISC:https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html  View
763938 87527 CVE-2016-10033 MISC:http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html  View
763939 87527 CVE-2016-10033 MISC:http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection  View
763940 87527 CVE-2016-10033 CONFIRM:https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html  View
763941 87527 CVE-2016-10033 CONFIRM:https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18  View
763942 87527 CVE-2016-10033 CONFIRM:https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities  View
763943 87527 CVE-2016-10033 CONFIRM:https://www.drupal.org/psa-2016-004  View
763944 87527 CVE-2016-10033 BID:95108  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
1191 JVNDB-2016-001964 Adobe Flash Player における任意のコードを実行される脆弱性 Adobe Flash Player には、任意のコードを実行される、またはサービス運用妨害 (メモリ破損) 状態にされる脆弱性が存在します。 CVE-2016-1021 87527 10 9.8 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-001964.html  View