CVE-2016-10033
PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.htmlExploitThird Party Advisory
- packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.htmlExploitThird Party Advisory
- seclists.org/fulldisclosure/2016/Dec/78Mailing ListPatch
- rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injectionExploitThird Party Advisory
- securityfocus.com/archive/1/539963/100/0/threadedBroken LinkThird Party Advisory
- securityfocus.com/bid/95108Broken LinkExploit
- securitytracker.com/id/1037533Broken LinkThird Party Advisory
- developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.htmlThird Party Advisory
- github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18PatchVendor Advisory
- github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilitiesPatchVendor Advisory
- legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.htmlExploitPatch
- drupal.org/psa-2016-004Third Party Advisory
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 456 days
- CVSS
- 9.8 CRITICAL
- EPSS (30-day exploit probability)
- 99.7% · top 1% of all CVEs
- Weakness
- CWE-88
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
- 1.Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.