NVD Vulnerability Detail

CVE-2016-10033

Summary	The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
Summary	La función mailSend en el transporte isMail en PHPMailer en versiones anteriores a 5.2.18 podrían permitir a atacantes remotos pasar parámetros extra al comando mail y consecuentemente ejecutar código arbitrario a través de una \" (barra invertida comillas dobles) en una propiedad Sender manipulada.
Publication Date	Dec. 31, 2016, 4:59 a.m.
Registration Date	Jan. 26, 2021, 2:04 p.m.
Last Update	April 22, 2026, 1:27 a.m.

CVSS3.1 : CRITICAL
スコア	9.8
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	不要
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高

CVSS2.0 : HIGH
Score	7.5
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	低
可用性への影響(A)	低
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:phpmailer_project:phpmailer::::::::				5.2.18
cpe:2.3:a:wordpress:wordpress::::::::		4.7
cpe:2.3:a:joomla:joomla\!::::::::	1.5.0	3.6.5

Related information, measures and tools

No	URL	refsource
1	http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html	cve@mitre.org
2	http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html	cve@mitre.org
3	http://seclists.org/fulldisclosure/2016/Dec/78	cve@mitre.org
4	http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection	cve@mitre.org
5	http://www.securityfocus.com/archive/1/539963/100/0/threaded	cve@mitre.org
6	http://www.securityfocus.com/bid/95108	cve@mitre.org
7	http://www.securitytracker.com/id/1037533	cve@mitre.org
8	https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html	cve@mitre.org
9	https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18	cve@mitre.org
10	https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities	cve@mitre.org
11	https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html	cve@mitre.org
12	https://www.drupal.org/psa-2016-004	cve@mitre.org
13	https://www.exploit-db.com/exploits/40968/	cve@mitre.org
14	https://www.exploit-db.com/exploits/40969/	cve@mitre.org
15	https://www.exploit-db.com/exploits/40970/	cve@mitre.org
16	https://www.exploit-db.com/exploits/40974/	cve@mitre.org
17	https://www.exploit-db.com/exploits/40986/	cve@mitre.org
18	https://www.exploit-db.com/exploits/41962/	cve@mitre.org
19	https://www.exploit-db.com/exploits/41996/	cve@mitre.org
20	https://www.exploit-db.com/exploits/42024/	cve@mitre.org
21	https://www.exploit-db.com/exploits/42221/	cve@mitre.org
22	http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html	af854a3a-2127-422b-91ae-364da2661108
23	http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html	af854a3a-2127-422b-91ae-364da2661108
24	http://seclists.org/fulldisclosure/2016/Dec/78	af854a3a-2127-422b-91ae-364da2661108
25	http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection	af854a3a-2127-422b-91ae-364da2661108
26	http://www.securityfocus.com/archive/1/539963/100/0/threaded	af854a3a-2127-422b-91ae-364da2661108
27	http://www.securityfocus.com/bid/95108	af854a3a-2127-422b-91ae-364da2661108
28	http://www.securitytracker.com/id/1037533	af854a3a-2127-422b-91ae-364da2661108
29	https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html	af854a3a-2127-422b-91ae-364da2661108
30	https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18	af854a3a-2127-422b-91ae-364da2661108
31	https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities	af854a3a-2127-422b-91ae-364da2661108
32	https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html	af854a3a-2127-422b-91ae-364da2661108
33	https://www.drupal.org/psa-2016-004	af854a3a-2127-422b-91ae-364da2661108
34	https://www.exploit-db.com/exploits/40968/	af854a3a-2127-422b-91ae-364da2661108
35	https://www.exploit-db.com/exploits/40969/	af854a3a-2127-422b-91ae-364da2661108
36	https://www.exploit-db.com/exploits/40970/	af854a3a-2127-422b-91ae-364da2661108
37	https://www.exploit-db.com/exploits/40974/	af854a3a-2127-422b-91ae-364da2661108
38	https://www.exploit-db.com/exploits/40986/	af854a3a-2127-422b-91ae-364da2661108
39	https://www.exploit-db.com/exploits/41962/	af854a3a-2127-422b-91ae-364da2661108
40	https://www.exploit-db.com/exploits/41996/	af854a3a-2127-422b-91ae-364da2661108
41	https://www.exploit-db.com/exploits/42024/	af854a3a-2127-422b-91ae-364da2661108
42	https://www.exploit-db.com/exploits/42221/	af854a3a-2127-422b-91ae-364da2661108
43	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033	134c704f-9b21-4f2e-91b3-4a467353bcc0

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-88	引数の挿入または変更	https://cwe.mitre.org/data/definitions/88.html

JVN Vulnerability Information

PHPMailer の isMail トランスポートの mailSend 関数における mail コマンドに余分なパラメータを渡される脆弱性

Title	PHPMailer の isMail トランスポートの mailSend 関数における mail コマンドに余分なパラメータを渡される脆弱性
Summary	PHPMailer の isMail トランスポートの mailSend 関数には、Sender プロパティが設定されていない場合、mail コマンドに余分なパラメータを渡され、その結果、任意のコードを実行される脆弱性が存在します。
Possible impacts	リモートの攻撃者により、\" (バックスラッシュダブルクオート) を含む巧妙に細工された From アドレスを介して、mail コマンドに余分なパラメータを渡され、その結果、任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Dec. 25, 2016, midnight
Registration Date	Jan. 4, 2017, 11:29 a.m.
Last Update	Jan. 4, 2017, 11:29 a.m.

Affected System

PHPMailer project

PHPMailer 5.2.18 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-10033	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10033
National Vulnerability Database (NVD)
2	CVE-2016-10033	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10033

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-77	https://cwe.mitre.org/data/definitions/77.html
2	CWE-78	https://jvndb.jvn.jp/ja/cwe/CWE-78.html

ベンダー情報

No	Name	URL
GitHub
1	About the CVE 2016 10033 and CVE 2016 10045 vulnerabilities	https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities
2	PHPMailer 5.2.18	https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18
Joomla! Developer Network
3	[20161205] - PHPMailer Security Advisory	https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html
Security advisories
4	DRUPAL-SA-PSA-2016-004	https://www.drupal.org/psa-2016-004
WordPress Trac
5	#37210	https://core.trac.wordpress.org/ticket/37210

その他

No	Name	URL
JVN
1	JVNVU#99931177	http://jvn.jp/vu/JVNVU99931177/index.html

Change Log

No	Changed Details	Date of change
0	[2017年01月04日] 掲載	Feb. 17, 2018, 10:37 a.m.