Описание
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted Sender property.
Ссылки
- ExploitThird Party AdvisoryVDB Entry
- ExploitThird Party AdvisoryVDB Entry
- Mailing ListPatchThird Party Advisory
- ExploitThird Party Advisory
- Broken LinkThird Party AdvisoryVDB Entry
- Broken LinkExploitThird Party AdvisoryVDB Entry
- Broken LinkThird Party AdvisoryVDB Entry
- Third Party Advisory
- PatchVendor Advisory
- PatchVendor Advisory
- ExploitPatchThird Party Advisory
- Third Party Advisory
- ExploitPatchThird Party AdvisoryVDB Entry
- ExploitThird Party AdvisoryVDB Entry
- ExploitPatchThird Party AdvisoryVDB Entry
- ExploitThird Party AdvisoryVDB Entry
- ExploitThird Party AdvisoryVDB Entry
- ExploitThird Party AdvisoryVDB Entry
- ExploitThird Party AdvisoryVDB Entry
- ExploitThird Party AdvisoryVDB Entry
Уязвимые конфигурации
EPSS
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
Связанные уязвимости
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
The mailSend function in the isMail transport in PHPMailer before 5.2. ...
Уязвимость функции mailSend библиотеки PHPMailer, позволяющая нарушителю выполнить произвольный код
ALT-PU-2016-2512: package `phpipam` update to version 1.26.050-alt1
EPSS
9.8 Critical
CVSS3
7.5 High
CVSS2