CVE-2016-10033

Published Dec 30, 2016

Last updated 23 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2016-10033 is a remote code execution vulnerability that exists in PHPMailer, a widely used PHP library for sending emails. The vulnerability is located in the `mailSend` function of the isMail transport method. It occurs because the `Sender` property is not properly sanitized. By injecting a backslash followed by a double quote (\") in a crafted `Sender` property, a remote attacker can pass extra parameters to the mail command. This can lead to the execution of arbitrary code on the affected server. The vulnerability was patched in PHPMailer version 5.2.18.

Description
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
Source
cve@mitre.org
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Primary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

CVSS 2.0

Type
Primary
Base score
7.5
Impact score
6.4
Exploitability score
10
Vector string
AV:N/AC:L/Au:N/C:P/I:P/A:P

Known exploits

Data from CISA

Vulnerability name
PHPMailer Command Injection Vulnerability
Exploit added on
Jul 7, 2025
Exploit action due
Jul 28, 2025
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

nvd@nist.gov
CWE-88
134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-88

Social media

Hype score
Not currently trending

Configurations

References

Sources include official advisories and independent security research.