CVE-2016-10033
Kritik CISA KEV: Aktif İstismarTeknik Veri (Otomatik)
- CVSS Skoru
- 9.8
- EPSS
- 99.7%
- CWE
- CWE-88
- KEV Durumu
- Evet
Yayım tarihi: 30 Aralık 2016 · CISA KEV son iyileştirme tarihi: 28 Temmuz 2025
Etkilenen: phpmailer_project phpmailer
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
Referanslar
- http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html
- http://seclists.org/fulldisclosure/2016/Dec/78
- http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection
- http://www.securityfocus.com/archive/1/539963/100/0/threaded
- http://www.securityfocus.com/bid/95108
Bu CVE için henüz editoryal inceleme yapılmadı. Sadece otomatik teknik veri gösteriliyor.