CVE-2016-10045
CRITICALPHPMailer < 5.2.20 - Remote Code Execution via Sendmail Argument Injection
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2016-10045. PoCs published by phackt_ul, Dawid Golunski.
AI-analyzed exploit summary This exploit targets PHPMailer, SwiftMailer, and Zend Framework mail libraries to achieve remote code execution via command injection in the email address field. It leverages Exim MTA's expansion mode and base64 encoding to bypass input validation and execute a reverse shell.
Description
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.
Exploits (3)
This exploit targets PHPMailer, SwiftMailer, and Zend Framework mail libraries to achieve remote code execution via command injection in the email address field. It leverages Exim MTA's expansion mode and base64 encoding to bypass input validation and execute a reverse shell.
This exploit targets multiple vulnerabilities in PHPMailer, SwiftMailer, and Zend-mail to achieve remote code execution via a contact form. It uploads a PHP backdoor containing a reverse shell payload to the target server.
This exploit leverages a command injection vulnerability in PHPMailer versions < 5.2.20 via the 'email' parameter. It crafts a malicious payload to write arbitrary PHP code to a writable directory, achieving remote code execution.
References (15)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H