CVE-2016-10045

CRITICAL

PHPMailer < 5.2.20 - Remote Code Execution via Sendmail Argument Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2016-10045. PoCs published by phackt_ul, Dawid Golunski.

AI-analyzed exploit summary This exploit targets PHPMailer, SwiftMailer, and Zend Framework mail libraries to achieve remote code execution via command injection in the email address field. It leverages Exim MTA's expansion mode and base64 encoding to bypass input validation and execute a reverse shell.

Description

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.

Exploits (3)

exploitdb WORKING POC
by phackt_ul · pythonwebappsphp
https://www.exploit-db.com/exploits/42221

This exploit targets PHPMailer, SwiftMailer, and Zend Framework mail libraries to achieve remote code execution via command injection in the email address field. It leverages Exim MTA's expansion mode and base64 encoding to bypass input validation and execute a reverse shell.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: PHPMailer < 5.2.20, SwiftMailer <= 5.4.5-DEV, Zend Framework / zend-mail < 2.4.11
No auth needed
Prerequisites: Vulnerable PHP mail library · Exim MTA as the mail transfer agent · Access to a contact form or similar input vector
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
by Dawid Golunski · pythonwebappsphp
https://www.exploit-db.com/exploits/40986

This exploit targets multiple vulnerabilities in PHPMailer, SwiftMailer, and Zend-mail to achieve remote code execution via a contact form. It uploads a PHP backdoor containing a reverse shell payload to the target server.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: PHPMailer < 5.2.20, SwiftMailer <= 5.4.5-DEV, Zend Framework / zend-mail < 2.4.11
No auth needed
Prerequisites: Target must have a vulnerable version of PHPMailer, SwiftMailer, or Zend-mail · Target must have a contact form with default or known field names · Attacker must have a listener set up for the reverse shell
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
by Dawid Golunski · pythonwebappsphp
https://www.exploit-db.com/exploits/40969

This exploit leverages a command injection vulnerability in PHPMailer versions < 5.2.20 via the 'email' parameter. It crafts a malicious payload to write arbitrary PHP code to a writable directory, achieving remote code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: PHPMailer < 5.2.20
No auth needed
Prerequisites: A writable directory on the target server · A vulnerable PHPMailer version · A contact form or similar input vector
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (15)

Core 15
Core References
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.html
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html
Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/42221/
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/40969/
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/539967/100/0/threaded
Mailing List, Patch mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2016/12/28/1
Patch, Vendor Advisory x_refsource_confirm
https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.20
Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/40986/
Exploit, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/95130
Mailing List, Patch, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2016/Dec/81
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1037533

Scores

CVSS v3 9.8
EPSS 0.9311
EPSS Percentile 99.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-77
Status published
Products (4)
joomla/joomla\! 1.5.0 - 3.6.5
phpmailer/phpmailer 5.0.0 - 5.2.20Packagist
phpmailer_project/phpmailer < 5.2.20
wordpress/wordpress < 4.7
Published Dec 30, 2016
Tracked Since Feb 18, 2026