CVE-2016-10045

Опубликовано: 30 дек. 2016

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Критический

Описание

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.

Ссылки

http://openwall.com/lists/oss-security/2016/12/28/1
Mailing List
Patch
http://packetstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2016/Dec/81
Mailing List
Patch
Third Party Advisory
http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection
Exploit
Third Party Advisory
http://www.securityfocus.com/archive/1/539967/100/0/threaded
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/95130
Exploit
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1037533
Third Party Advisory
VDB Entry
https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html
Third Party Advisory
https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.20
Patch
Vendor Advisory
https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities
Patch
Vendor Advisory
https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html
Exploit
Patch
Third Party Advisory
https://www.exploit-db.com/exploits/40969/
Exploit
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/40986/
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/42221/
Third Party Advisory
VDB Entry
http://openwall.com/lists/oss-security/2016/12/28/1
Mailing List
Patch
http://packetstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2016/Dec/81
Mailing List
Patch
Third Party Advisory
http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:phpmailer_project:phpmailer:*:*:*:*:*:*:*:*

Версия до 5.2.20 (исключая)

Конфигурация 2

cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*

Версия до 4.7 (включая)

Конфигурация 3

cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*

Версия от 1.5.0 (включая) до 3.6.5 (включая)

EPSS

Процентиль: 100%

0.93786

Критический

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-77

Связанные уязвимости

CVE-2016-10045

CVSS3: 9.8

ubuntu

больше 8 лет назад

CVE-2016-10045

CVSS3: 9.8

debian

больше 8 лет назад

The isMail transport in PHPMailer before 5.2.20 might allow remote att ...

GHSA-4pc3-96mx-wwc8

CVSS3: 9.8

github

больше 5 лет назад

Remote code execution in PHPMailer

EPSS

Процентиль: 100%

0.93786

Критический

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-77