The isMail transport in PHPMailer before 5.2.20 has a flaw in how it passes parameters to the mail command, stemming from an incorrect fix for an earlier issue. Remote attackers can exploit improper interaction between the escapeshellarg function and the internal escaping performed by PHP's mail function to inject extra parameters and execute arbitrary code.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.
Public exploit code (Metasploit) was available 4 days before disclosure.
A fix was bypassed or incomplete once on the same day. The latest fix listed for phpmailer/phpmailer is 6.0.6.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: phpmailer/phpmailer.
Upgrade to 5.2.20 or later
Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2008-5619, CVE-2016-10033).
Set the version to 5.2.20 or later in your composer.json.
The first fix for CVE-2016-10045.
| If you run | Upgrade to |
|---|---|
| 5.0.0 up to 5.2.20 | 5.2.20 |
“Up to” means the second version is the fix and is not affected.