NVD

Id
17430  
Name
CVE-2016-10045  
Description
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-30  
Published
2016-12-30  
Modified Date
2017-01-25  
Seq
2016-10045  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
96479 17430 CVE-2016-10045 [oss-security] 20161228 Re: PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033]  View
96480 17430 CVE-2016-10045 http://packetstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.html  View
96481 17430 CVE-2016-10045 http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html  View
96482 17430 CVE-2016-10045 20161227 PHPMailer < 5.2.20 Remote Code Execution PoC 0day Exploit (CVE-2016-10045) (Bypass of the CVE-2016-1033 patch)  View
96483 17430 CVE-2016-10045 http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection  View
96484 17430 CVE-2016-10045 20161228 PHPMailer < 5.2.20 Remote Code Execution PoC 0day Exploit (CVE-2016-10045) (Bypass of the CVE-2016-1033 patch)  View
96485 17430 CVE-2016-10045 95130  View
96486 17430 CVE-2016-10045 https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html  View
96487 17430 CVE-2016-10045 https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.20  View
96488 17430 CVE-2016-10045 https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities  View
96489 17430 CVE-2016-10045 https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html  View
96490 17430 CVE-2016-10045 40969  View

Related JVN