PT-2020-5653 · Php+3 · Phpmailer+3

Elar Lang · Published 2020-05-27 · Updated 2024-06-15 · CVE-2020-13625

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions PHPMailer versions prior to 6.1.6

Description The issue is related to an output escaping bug in PHPMailer. When the name of a file attachment contains a double quote character, it can result in the file type being misinterpreted by the receiver or any mail relay processing the message. This bug is associated with a lack of output encoding or escaping mechanism in multiple functions of the PHPMailer class. The exploitation of this bug can allow a remote attacker to impact data integrity.

Recommendations For versions prior to 6.1.6, update to version 6.1.6 or later to resolve the issue. As a temporary workaround, consider avoiding the use of double quote characters in file attachment names until a patch is applied. Restrict access to the vulnerable PHPMailer functions to minimize the risk of exploitation.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

BDU:2021-01353

BIT-PHPMAILER-2020-13625

CVE-2020-13625

DLA-2244-1

DLA-2306-1

GHSA-F7HX-FQXW-RVVJ

MGASA-2020-0313

OPENSUSE-SU-2020:1060-1

OPENSUSE-SU-2020:1106-1

OPENSUSE-SU-2020_1060-1

OPENSUSE-SU-2024:10670-1

USN-4505-1

USN-5956-1

Affected Products

Linuxmint

Phpmailer

Suse

Ubuntu

References · 90

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/cacti_filter_sqli_rce.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_phpmailer_host_header.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/phpmailer_arg_injection.rb · Exploit
• 🔥 https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-f7hx-fqxw-rvvj · Exploit
• 🔥 https://github.com/opsxcq/exploit-CVE-2016-10033 · Exploit
• 🔥 https://github.com/0xAJ2K/CVE-2020-11022-CVE-2020-11023 · Exploit
• 🔥 https://github.com/GeneralTesler/CVE-2016-10033 · Exploit
• 🔥 https://github.com/chipironcin/CVE-2016-10033 · Exploit
• 🔥 https://github.com/0x00-0x00/CVE-2016-10033 · Exploit
• 🔥 https://github.com/ossf-cve-benchmark/CVE-2020-11022 · Exploit
• https://ubuntu.com/security/CVE-2018-19296 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-phpmailer-2020-13625 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-11503 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f7hx-fqxw-rvvj · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5956-1 · Vendor Advisory