PT-2017-12058 · Php+2 · Phpmailer+2

Shahab Shamsi · Publicado 2017-07-20 · Atualizado 2023-03-15 · CVE-2017-11503

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHPMailer version 5.2.23

Description The issue concerns a problem with the "From Email Address" and "To Email Address" fields in the code generator.php file, where there is XSS.

Recommendations For PHPMailer version 5.2.23, consider validating and sanitizing user input in the "From Email Address" and "To Email Address" fields to prevent XSS attacks. As a temporary workaround, restrict access to the code generator.php file until a fix is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-11503

GHSA-58MJ-PW57-4VM2

MGASA-2017-0257

USN-5956-1

USN-5956-2

Produtos afetados

Linuxmint

Phpmailer

Ubuntu

Referências · 36

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/phpmailer_arg_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_phpmailer_host_header.rb · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2017-11503.yaml · Exploit
• 🔥 https://github.com/opsxcq/exploit-CVE-2016-10033 · Exploit
• 🔥 https://github.com/GeneralTesler/CVE-2016-10033 · Exploit
• 🔥 https://github.com/chipironcin/CVE-2016-10033 · Exploit
• 🔥 https://github.com/0x00-0x00/CVE-2016-10033 · Exploit
• 🔥 https://packetstormsecurity.com/files/143138/phpmailer-xss.txt · Exploit
• 🔥 https://cxsecurity.com/issue/WLB-2017060181 · Exploit
• https://github.com/PHPMailer/PHPMailer · Nota
• https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.24 · Correção
• https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-58mj-pw57-4vm2 · Nota
• https://ubuntu.com/security/CVE-2016-10033 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-11503 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-5223 · Aviso do Fabricante