NVD

Id
17423  
Name
CVE-2016-10033  
Description
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted Sender property.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-30  
Published
2016-12-30  
Modified Date
2017-01-25  
Seq
2016-10033  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
96452 17423 CVE-2016-10033 http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html  View
96453 17423 CVE-2016-10033 http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html  View
96454 17423 CVE-2016-10033 20161227 PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033]  View
96455 17423 CVE-2016-10033 http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection  View
96456 17423 CVE-2016-10033 20161227 PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033]  View
96457 17423 CVE-2016-10033 95108  View
96458 17423 CVE-2016-10033 https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html  View
96459 17423 CVE-2016-10033 https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18  View
96460 17423 CVE-2016-10033 https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities  View
96461 17423 CVE-2016-10033 https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html  View
96462 17423 CVE-2016-10033 https://www.drupal.org/psa-2016-004  View
96463 17423 CVE-2016-10033 40968  View
96464 17423 CVE-2016-10033 40970  View

Related JVN