crítica
CVE-2016-10045
Remote Code Execution
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA. Más baja según Ubuntu (media).
Descripción
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| composer::GitHub Security Advisory Composer | phpmailer/phpmailer | 5.2.20 |
| alpine 3.2 | php-phpmailer | 5.2.4-r0 |
| alpine 3.3 | php-phpmailer | 5.2.4-r0 |
| alpine 3.4 | php5-phpmailer | 5.2.0-r1 |
| alpine 3.5 | php5-phpmailer | 5.2.4-r1 |
| composer::PHP Security Advisories Database | phpmailer/phpmailer | sin corrección indicada |
| ubuntu 16.04-ESM | libphp-phpmailer | 5.2.14+dfsg-1ubuntu0.1~esm1 |
Referencias
- http://openwall.com/lists/oss-security/2016/12/28/1
- http://packetstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html
- http://seclists.org/fulldisclosure/2016/Dec/81
- http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection
- http://www.securityfocus.com/archive/1/539967/100/0/threaded
- http://www.securityfocus.com/bid/95130
- http://www.securitytracker.com/id/1037533
Las 24 referencias
- https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html
- https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2016-10045.yaml
- https://github.com/PHPMailer/PHPMailer
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.20
- https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-4pc3-96mx-wwc8
- https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html
- https://nvd.nist.gov/vuln/detail/CVE-2016-10045
- https://ubuntu.com/security/notices/USN-5956-1
- https://www.cve.org/CVERecord?id=CVE-2016-10045
- https://www.exploit-db.com/exploits/40969
- https://www.exploit-db.com/exploits/40969/
- https://www.exploit-db.com/exploits/40986
- https://www.exploit-db.com/exploits/40986/
- https://www.exploit-db.com/exploits/42221
- https://www.exploit-db.com/exploits/42221/