CVE-2016-10074
CRITICALSwiftMailer < 5.4.5 - Remote Code Execution via Mail Command Parameter Injection
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2016-10074. PoCs published by phackt_ul, Dawid Golunski.
AI-analyzed exploit summary This exploit targets PHPMailer, SwiftMailer, and Zend Framework mail libraries to achieve remote code execution via command injection in the email address field. It leverages Exim MTA's expansion mode and base64 encoding to bypass input validation and execute a reverse shell.
Description
The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.
Exploits (3)
This exploit targets PHPMailer, SwiftMailer, and Zend Framework mail libraries to achieve remote code execution via command injection in the email address field. It leverages Exim MTA's expansion mode and base64 encoding to bypass input validation and execute a reverse shell.
This exploit targets multiple vulnerabilities in PHPMailer, SwiftMailer, and Zend-mail to achieve remote code execution via a contact form. It uploads a PHP backdoor containing a reverse shell payload to the target server.
This exploit leverages a parameter injection vulnerability in SwiftMailer to execute arbitrary commands via the sendmail MTA. It injects malicious parameters into the 'From' field to write a PHP payload to a writable directory.
References (9)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H