CVE-2016-10045: Remote Code Execution in PHPMailer
Summary
CVE-2016-10045: Remote code execution in PHPMailer. Affects phpmailer/phpmailer versions >= 5.0.0, < 5.2.20. Fixed in 5.2.20. How to fix ↓
Also tracked for
- php-phpmailer · Alpine:v3.2
The same CVE-2016-10045 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHPMailer is a popular open-source library used for sending emails via PHP. It provides a range of features and transport options for sending emails. However, versions before 5.2.20 are vulnerable to remote code execution.
Vulnerability Detail
The vulnerability, known as CVE-2016-10045, allows remote attackers to execute arbitrary code by exploiting improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. This vulnerability exists due to an incorrect fix for a previous vulnerability (CVE-2016-10033). By passing extra parameters to the mail command, an attacker can execute arbitrary code on the target system. The impact of this vulnerability is critical, as it allows for unauthorized code execution.
How To Fix
Minimum fixed version
5.2.20
This is the first release that contains the fix.
composer require phpmailer/phpmailer:5.2.20Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, instead of using the mail() function, it is advised to send emails via SMTP to localhost. This avoids the use of the vulnerable mail() function and reduces the risk of exploitation.
Conclusion
The vulnerability in PHPMailer (CVE-2016-10045) allows remote code execution, posing a critical risk to systems using affected versions. To mitigate this vulnerability, it is crucial to update PHPMailer to version 5.2.20 or later. Additionally, using SMTP to localhost instead of the mail() function can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmailer/phpmailer →
FAQ
PHPMailer is an open-source library used for sending emails via PHP. It provides various features and transport options for sending emails.
CVE-2016-10045 is a vulnerability in PHPMailer versions before 5.2.20 that allows remote code execution. It is caused by improper interaction between the escapeshellarg function and internal escaping in the mail function in PHP.
The impact of this vulnerability is critical, as it allows remote attackers to execute arbitrary code on the target system. This can lead to unauthorized access, data breaches, and other malicious activities.
To fix this vulnerability, update PHPMailer to version 5.2.20 or later. This version includes a patch that addresses the issue and prevents remote code execution.
Yes, instead of using the vulnerable mail() function, it is recommended to send emails via SMTP to localhost. This avoids the risk of exploitation through the mail() function.
Related vulnerabilities
Recent vulnerabilities recorded for phpmailer/phpmailer.
