CVE-2017-15806

28Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 11%

from disclosure to weapon1 days

Published on NVDNov 15

1st PoC+1d

exploitation probability

11%top 5% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address, as demonstrated by one containing "-X/path/to/wwwroot/file.php."

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/43155/unverified exploitdbwww.exploit-db.com/exploits/43155unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://github.com/zetacomponents/Mail/issues/58 https://github.com/zetacomponents/Mail/releases/tag/1.8.2 https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-critical-rce-vulnerability/https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-yuan-cheng-dai-ma-zhi-xing-lou-dong/https://www.exploit-db.com/exploits/43155/http://www.securityfocus.com/bid/101866