PT-2016-4560 · Php+4 · Phpmailer+4

Dawid Golunski + 1 · Publicado 2016-12-29 · Atualizado 2025-07-13 · CVE-2016-10033

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHPMailer versions prior to 5.2.18 Wordpress version 4.6

Description The issue allows remote attackers to execute arbitrary code. This can be achieved by passing extra parameters to the mail command via a crafted Sender property in PHPMailer. There is a potential for remote code execution in Wordpress 4.6.

Recommendations For PHPMailer versions prior to 5.2.18, update to version 5.2.18 or later to resolve the issue. For Wordpress version 4.6, update to a newer version to mitigate the risk of remote code execution.

Exploit

Correção

Argument Injection

Command Injection

Enumeração de Fraquezas

CWE-88

CWE-77

Identificadores relacionados

ALT-PU-2016-2512

ALT-PU-2017-1015

ALT-PU-2023-1810

ALT-PU-2023-1837

BDU:2025-11542

CVE-2016-10033

DLA-770-1

DSA-3750-1

DSA-3750-2

GHSA-4PC3-96MX-WWC8

GHSA-5F37-GXVH-23V6

MGASA-2017-0022

USN-5956-1

Produtos afetados

Alt Linux

Linuxmint

Phpmailer

Ubuntu

Wordpress

Referências · 86

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/phpmailer_arg_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_phpmailer_host_header.rb · Exploit
• 🔥 https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2016-10033.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2015-8476.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2016-10045.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2017-5223.yaml · Exploit
• 🔥 https://github.com/opsxcq/exploit-CVE-2016-10033 · Exploit
• 🔥 https://github.com/GeneralTesler/CVE-2016-10033 · Exploit
• 🔥 https://github.com/Zenexer/safeshell · Exploit
• 🔥 https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2019-16693.md · Exploit
• 🔥 https://github.com/kkirsche/CVE-2019-16692 · Exploit
• 🔥 https://github.com/chipironcin/CVE-2016-10033 · Exploit
• 🔥 https://github.com/0x00-0x00/CVE-2016-10033 · Exploit
• 🔥 https://exploit-db.com/exploits/42024 · Exploit