CVE-2016-10033

Description

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

Scoring

• CVSS: 9.8 (CRITICAL, 3.1)
• EPSS exploitation probability: Not yet available
• EPSS percentile: Not yet available

CISA KEV status

• Added to KEV: 2025-07-07
• Remediation due date: 2025-07-28
• Known ransomware campaign use: Unknown

Weakness types (CWE)

• CWE-88
• CWE-88

References

• http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html
• http://seclists.org/fulldisclosure/2016/Dec/78
• http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection
• http://www.securityfocus.com/archive/1/539963/100/0/threaded
• http://www.securityfocus.com/bid/95108
• http://www.securitytracker.com/id/1037533
• https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html
• https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18
• https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities

More from PHP

• CVE-2019-11043 — FastCGI Process Manager (FPM)
• CVE-2012-1823 — PHP