CVE-2017-5223

MEDIUM

PHPMailer <5.2.22 - Code Injection

Title source: llm
STIX 2.1

Description

An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base directory. If no base directory is provided, it resolves to /, meaning that relative image URLs get treated as absolute local file paths and added as attachments. To form a remote vulnerability, the msgHTML method must be called, passed an unfiltered, user-supplied HTML document, and must not set a base directory.

Exploits (2)

exploitdb WORKING POC
by Maciek Krupa · pythonwebappsphp
https://www.exploit-db.com/exploits/43056
nomisec WORKING POC 1 stars
by cscli · poc
https://github.com/cscli/CVE-2017-5223

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/95328
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/43056/
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://github.com/PHPMailer/PHPMailer/blob/master/SECURITY.md

Scores

CVSS v3 5.5
EPSS 0.0292
EPSS Percentile 86.5%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-200
Status published
Products (2)
phpmailer/phpmailer 5.0.0 - 5.2.22Packagist
phpmailer_project/phpmailer < 5.2.21
Published Jan 16, 2017
Tracked Since Feb 18, 2026